A critical privilege management flaw in Craft CMS before 5.10.11 lets an unauthenticated attacker register an account under a deactivated administrator's email address and inherit that account's administrator privileges.
What Is It
CVE-2026-84795 is an improper privilege management issue (CWE-269) in Craft CMS. The platform fails to validate the admin flag during user registration, allowing the flag to persist from deactivated admin accounts. An attacker who knows or guesses the email address of a deactivated administrator can register with that address and come out the other side holding administrator rights.
The bug carries a CVSS v3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.2 (CRITICAL) was also assigned, differing mainly in that it records attack requirements as present; reflecting the specific configuration the attack depends on. The record was published 2026-09-02 by [email protected] and is currently in Deferred status.
Why It Matters
The attack is remote, needs no prior privileges, and requires no user interaction. Confidentiality, integrity, and availability impacts are all rated High; administrator access to a CMS is effectively full control of the site's content and configuration.
The caveat is the precondition: per the Craft CMS security advisory (GHSA-242m-9wq7-vhwq), exploitation requires the site to have public registration enabled and email verification disabled. That combination is not universal, but it is a supported Craft configuration, and any site running it with a deactivated admin account on file is directly exposed.
CVE-2026-84795 does not appear in CISA's Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Neither the Craft CMS GitHub Security Advisory nor the VulnCheck advisory reports exploitation in the wild, and the NVD record carries no exploitation references. Exploit maturity in the CVSS v4.0 vector is Not Defined.
What's Vulnerable
- Vendor/product: craftcms; cms
- Affected: versions 5.0.0-RC1 up to (but not including) 5.10.11
- Not affected: 5.10.11 and later
No CPE match data was published with the record.
Patch Status
Craft CMS 5.10.11 is the fixed release. Operators on any 5.x build below that version should upgrade. As an interim measure, the attack path depends on public registration combined with disabled email verification; sites that cannot patch immediately should review that configuration.
Sources
- Craft CMS GitHub Security Advisory (GHSA-242m-9wq7-vhwq), https://github.com/craftcms/cms/security/advisories/GHSA-242m-9wq7-vhwq
- VulnCheck Advisory; https://www.vulncheck.com/advisories/craft-cms-before-5.10.11-authentication-bypass-via-admin-flag-inheritance
- NVD, CVE-2026-84795, https://nvd.nist.gov/vuln/detail/CVE-2026-84795
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog