CVE-2026-79987

HighCVSS 8.8/10Last modified Sep 11, 2026

Description

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-470

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-799888.7The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE CVE-2026-799898.7The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elev CVE-2026-79994.3Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive informa CVE-2026-799908.7Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManager CVE-2026-799917.1Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManager CVE-2026-799927.8A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs CVE-2026-799937.5The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to del CVE-2026-799948.7The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later rec CVE-2026-799954.3The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cance CVE-2026-799967.2The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowi CVE-2026-80008.8Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to e CVE-2026-80018.3Use After Free in Printing in Google Chrome on Linux, Mac, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the