CVE-2026-72786

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72786
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72786.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72786
Aliases
Published
2026-08-12T19:07:35.873Z
Modified
2026-08-15T11:30:57.621737039Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
Details

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72786.json"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
04755d93f86d07cc183db47db8a0eee106892e30
Fixed
b4ff213cd88743cf08829e86281dc95c57fc83b8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.10.8"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72786.json"