Medium severity6.5NVD Advisory· Published Aug 12, 2026

CVE-2026-72786

Description

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.

Affected products

Craftcms/CMSllm-fuzzy
Range: <5.10.8

Patches

Vulnerability mechanics

References

github.com/craftcms/cms/security/advisories/GHSA-p8x7-9vfw-p7vcnvd
www.vulncheck.com/advisories/craft-cms-rc1-before-authentication-bypass-via-password-resetnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000