CVE-2026-86731 Overview
Craft CMS versions 5.0.0-RC1 through 5.10.11 contain a missing authorization check in the UsersController::actionActivateUser method that handles the users/activate-user action. The action requires the administrateUsers permission but omits the requireAdmin() guard when the target account is an administrator. This asymmetry with actionDeactivateUser allows a non-administrator control panel user to activate a pending or deactivated administrator account. Combined with a password reset on that account, the flaw enables privilege escalation to full administrator rights. The issue is fixed in Craft CMS 5.10.12 and is tracked as [CWE-862: Missing Authorization].
Critical Impact
An authenticated low-privileged control panel user holding the administrateUsers permission can activate dormant administrator accounts and escalate to full administrative control.
Affected Products
- Craft CMS 5.0.0-RC1 through 5.10.11
- Craft CMS control panel users/activate-user action
- Fixed in Craft CMS 5.10.12
Discovery Timeline
- 2026-09-08 - CVE-2026-86731 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86731
Vulnerability Analysis
The flaw resides in the UsersController::actionActivateUser method inside the Craft CMS control panel. The action verifies that the caller holds the administrateUsers permission but does not additionally invoke requireAdmin() when the targeted user is an administrator. The mirror action actionDeactivateUser correctly enforces requireAdmin() under the same conditions, exposing the asymmetric access-control check as the root defect.
Exploitation grants attackers the ability to re-enable dormant or deliberately quarantined administrator accounts. Because Craft CMS permits password reset flows against user accounts an operator can administrate, the attacker chains activation with a password reset. The final result is authenticated access to an administrator account controlled by the attacker.
Root Cause
The root cause is a missing authorization check on a privileged target. The administrateUsers permission was intended for user lifecycle management of non-administrator accounts. The controller fails to elevate the required permission when the user record being modified is itself flagged as an administrator, producing the [CWE-862] condition.
Attack Vector
Exploitation requires network access to the Craft CMS control panel and an authenticated session holding the administrateUsers permission. The attacker submits a request to the users/activate-user endpoint targeting a pending or deactivated administrator account. After activation, the attacker triggers the standard password reset workflow against the same account and completes authentication as an administrator.
No verified proof-of-concept code has been published. See the GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for technical details.
Detection Methods for CVE-2026-86731
Indicators of Compromise
- HTTP requests to the users/activate-user control panel action targeting user IDs associated with administrator accounts.
- Sudden state transitions of administrator accounts from pending or suspended to active without a corresponding administrator session initiating the change.
- Password reset emails or token generation events for administrator accounts shortly after an activation event.
- New authenticated administrator sessions originating from IP addresses previously associated with lower-privileged control panel users.
Detection Strategies
- Correlate Craft CMS application logs for users/activate-user requests with the acting user's assigned role to flag non-administrator callers acting on administrator targets.
- Alert on any sequence of activation followed by password reset against the same administrator user ID within a short time window.
- Baseline the population of accounts holding the administrateUsers permission and review unexpected additions.
Monitoring Recommendations
- Ingest Craft CMS web server and application logs into a centralized analytics platform for control panel action auditing.
- Track authentication events, permission changes, and account state transitions for administrator accounts as high-priority telemetry.
- Monitor outbound password reset email volume for anomalies tied to privileged accounts.
How to Mitigate CVE-2026-86731
Immediate Actions Required
- Upgrade all Craft CMS installations to version 5.10.12 or later without delay.
- Audit accounts holding the administrateUsers permission and revoke it from users who do not require full user lifecycle authority.
- Review all administrator accounts and disable or delete any pending, dormant, or unused administrator records.
- Rotate passwords and invalidate active sessions for administrator accounts after patching.
Patch Information
The vendor fix is available in Craft CMS 5.10.12. The patched release adds the missing requireAdmin() guard to UsersController::actionActivateUser, aligning its authorization logic with actionDeactivateUser. Refer to the GitHub Security Advisory GHSA-jqf5-vfg6-8cx5 for release notes and commit references.
Workarounds
- Restrict access to the Craft CMS control panel using network-level controls such as VPN or IP allow-listing until the patch is applied.
- Temporarily remove the administrateUsers permission from all non-administrator user groups.
- Delete or hard-suspend any administrator account that is not actively required, eliminating the target of the activation flow.
# Verify installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.10.12 -w
php craft up
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.