CVE-2026-84795CWE-269privilege-escalation

CVE-2026-84795

Critical · published September 2, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-09-02T16:17Z
References (2)
https://github.com/craftcms/cms/security/advisories/GHSA-242m-9wq7-vhwq · [email protected]https://www.vulncheck.com/advisories/craft-cms-before-5.10.11-authentication-bypass-via-admin-flag-inheritance · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 11:11Z
    Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
    cvelistv5