CVE-2026-112775
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Oct 19, 2026
Vendor
unknown
Description
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.