Description

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-02T12:17:16.093Z",
  "pubdate": "2026-09-02T12:17:16.093Z",
  "executiveSummary": "Craft CMS versions prior to 5.10.11 contain a critical security vulnerability involving improper validation of user registration parameters.\nThe flaw stems from a failure to strictly sanitize or re-validate the administrative status of a user account during the registration process when utilizing existing email identifiers.\nWhen public registration and disabled email verification are concurrently enabled, an unauthenticated attacker can register an account using the email address of a previously deactivated administrative user.\nThis action causes the new account to inherit the administrative privileges associated with the deactivated identity, leading to full system compromise.\nThis vulnerability allows unauthenticated remote attackers to escalate their privileges to an administrator level, circumventing identity and access management controls.\nThe primary risk implication is a total breach of the CMS, allowing unauthorized access to sensitive data, administrative configurations, and arbitrary command execution if administrative templates or plugins are leveraged.",
  "technicalDetails": "The vulnerability resides within the user registration logic of Craft CMS, specifically where the system handles account creation requests involving existing, albeit deactivated, email addresses.\nThe root cause is an insecure state management issue where the application fails to reset or clear administrative flags when a new registration is linked to an existing identity record that has been flagged as deactivated.\nUnder standard conditions, an administrator account that is deactivated should be isolated; however, the registration workflow allows for a state collision where the registration process incorrectly maps the incoming request to the historical administrative attributes of the deactivated record.\nExploitation is contingent upon specific system configurations: public user registration must be enabled, and the mandatory email verification workflow must be disabled, which bypasses the standard verification handshake that might otherwise identify the conflict.\nThe attack flow proceeds as follows: First, an attacker identifies an email address associated with a deactivated administrative account. Second, the attacker submits a registration request using this email address via the public-facing registration interface. Third, the backend registration controller fails to perform a secondary validation check to ensure the administrative status flag is set to false for the new account creation event.\nBecause the system persists the status from the legacy deactivated record, the newly created account is automatically promoted to an administrative role upon creation.\nThis bypasses the intended authorization chain, providing the attacker with elevated access to the Craft CMS control panel, which grants full oversight of site assets, user management, and core configuration settings.\nThe vulnerability affects all versions of Craft CMS prior to 5.10.11, and the exposure is network-based, reachable by any unauthenticated remote user capable of interacting with the registration endpoint.\nPost-exploitation, the attacker gains persistent administrative control, allowing for the deployment of malicious plugins or the manipulation of system templates, further cementing access and facilitating lateral movement within the hosting environment."
}