CVE-2026-84795

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-84795

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84795.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-84795

Aliases

GHSA-242m-9wq7-vhwq

Published

2026-09-02T11:11:11Z

Modified

2026-10-21T03:00:23Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance

Details

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-269"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84795.json"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

04755d93f86d07cc183db47db8a0eee106892e30

Fixed

9dece66d9d35f9f2615f5f2107c98d2334c71cfc

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "5.0.0-RC1"
                },
                {
                    "fixed":  "5.10.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.10.11"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84795.json"