Description

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T20:17:49.837Z",
  "pubdate": "2026-08-12T20:17:49.837Z",
  "executiveSummary": "Craft CMS versions prior to 5.10.8 suffer from a critical authentication bypass vulnerability residing within the elements/save action flow.\nThe flaw allows authenticated users possessing edit users permissions to execute arbitrary password modifications for any user account, including high-privileged administrators, without requiring verification of the existing password or secondary confirmation.\nThis vulnerability poses a severe risk to confidentiality, integrity, and availability, effectively leading to total application compromise and privilege escalation.\nThe attack vector requires the malicious actor to already hold specific administrative or editing privileges within the application's access control matrix, specifically the ability to edit user objects.\nExploitation is carried out by manipulating the unprotected newPassword field during the processing of User element save operations.\nOrganizations utilizing affected instances of Craft CMS face immediate account takeover risks if insider threats or compromised accounts with edit users permissions are leveraged by adversaries.",
  "technicalDetails": "The root cause of this vulnerability lies in inadequate input validation and missing cryptographic verification checks within the user element persistence logic of Craft CMS.\nSpecifically, the vulnerability manifests in the elements/save action where user entities are processed and updated.\nThe application fails to enforce the requirement for the current password when a modification to the newPassword field is submitted within the User element save flow.\nAffected versions include all iterations of Craft CMS prior to 5.10.8.\nThe authentication requirement dictates that the attacker must possess valid credentials and sufficient role-based permissions, specifically the edit users capability, to interact with the vulnerable endpoint.\nNetwork exposure involves standard administrative interface accessibility over HTTP or HTTPS protocols.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker with edit users privileges initiates a request targeting the elements/save action for a specific user record.\nSecond, the attacker injects or modifies the unprotected newPassword parameter within the payload data structure directed at the User element save routine.\nThird, the Craft CMS backend processes the incoming request via the vulnerable elements/save handler without challenging the requester for the target user's current password or requiring administrative token validation.\nFourth, the database record updates with the newly supplied credential string, immediately overwriting the authentication material for the targeted account.\nThe post-exploitation impact includes instantaneous account takeover, allowing the attacker to lock out legitimate administrators, establish persistent backdoor access, and compromise the underlying infrastructure governed by the Craft CMS application."
}