CVE-2026-72786CWE-285

CVE-2026-72786

Medium · published August 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-08-13T00:17Z
References (2)
https://github.com/craftcms/cms/security/advisories/GHSA-p8x7-9vfw-p7vc · [email protected]https://www.vulncheck.com/advisories/craft-cms-rc1-before-authentication-bypass-via-password-reset · [email protected]
EPSS history
Timeline
  • 12 AUG 19:07Z
    Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
    cvelistv5