CVE-2026-84801

HighCVSS 8.8/10Last modified Sep 2, 2026

Description

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-848024.3Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails CVE-2026-848039.0SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that mis CVE-2026-848045.4Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoint CVE-2026-848054.3Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/user CVE-2026-848065.4Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit CVE-2026-848075.4Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. CVE-2026-848084.3Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enfor CVE-2026-848096.5Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories an CVE-2026-84819.9IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /CVE-2026-848106.5claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python CVE-2026-848116.5agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scan CVE-2026-848127.1Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.