CVE-2026-84801
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Sep 02, 2026
Vendor
unknown
Description
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.