CVE-2026-79989

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-79989

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79989.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-79989

Aliases

Published

2026-09-02T14:11:02.784Z

Modified

2026-09-04T03:45:26.480180606Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Arbitrary user password reset leading to administrator account takeover

Details

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

Database specific

{
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79989.json",
    "cna_assigner": "Hackrate"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

04755d93f86d07cc183db47db8a0eee106892e30

Fixed

b4ff213cd88743cf08829e86281dc95c57fc83b8

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.10.8"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79989.json"