CVE-2026-79989

Published: Sep 2, 2026Modified: Sep 2, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 7004884b-51e2-48e8-b4a2-5ca29e80453e (Secondary)

Description

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://github.com/advisories/GHSA-p8x7-9vfw-p7vc

Source: 7004884b-51e2-48e8-b4a2-5ca29e80453e

https://github.com/craftcms/cms

Source: 7004884b-51e2-48e8-b4a2-5ca29e80453e

https://github.com/craftcms/cms/releases/tag/5.10.8

Source: 7004884b-51e2-48e8-b4a2-5ca29e80453e

https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH

Source: 7004884b-51e2-48e8-b4a2-5ca29e80453e

Timeline

No history available yet.