Description

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T12:17:16.910Z",
  "pubdate": "2026-09-02T12:17:16.910Z",
  "executiveSummary": "Craft CMS versions prior to 5.10.11 contain a critical improper authorization vulnerability within the administrative password reset workflow.\nThe flaw stems from insufficient validation of administrative privileges within the actionGetPasswordResetUrl endpoint and a lack of session-binding during the password reset process.\nAn attacker possessing the administrateUsers permission can exploit this vulnerability to generate valid password reset URLs for arbitrary administrator accounts.\nBy manipulating the actionSetPassword endpoint, the attacker can then finalize the password change without requiring the original credentials or session validation.\nThis vulnerability leads to full account takeover, granting an unauthorized user total control over the administrative panel and the underlying Craft CMS instance.\nThe risk is severe, as it allows privilege escalation from a low-level administrative permission set to full superuser/administrator access.\nSuccessful exploitation does not require advanced access beyond the standard administrateUsers privilege, significantly lowering the barrier for potential exploitation.",
  "technicalDetails": "The vulnerability is located in the password management subsystem of Craft CMS, specifically involving the interaction between the actionGetPasswordResetUrl and actionSetPassword methods.\nRoot Cause: The actionGetPasswordResetUrl endpoint fails to perform a secondary validation check to ensure that the user requesting a password reset URL for an administrator account holds the necessary superuser or equivalent administrative status. Furthermore, the actionSetPassword endpoint relies solely on the presence of a valid verification code (token) provided via the reset URL.\nAttack Flow: An attacker with the administrateUsers permission authenticates to the control panel. The attacker invokes the actionGetPasswordResetUrl endpoint, supplying the UID of a targeted administrator account. Due to the lack of server-side privilege validation, the application generates a cryptographically valid password reset URL for the target account.\nExploitation Method: Upon receiving the reset URL, the attacker redirects their session (or utilizes the URL directly) to the actionSetPassword endpoint. Because actionSetPassword validates only the integrity and existence of the verification code and fails to enforce a match between the current session and the intended recipient of the reset request, the application updates the password for the target administrator account.\nAuthentication/Privilege Requirements: The attacker must hold the administrateUsers permission. This is a common permission granted to sub-administrators or user managers, meaning the exploit is accessible to authenticated users who are not necessarily superusers.\nVulnerable Versions: All Craft CMS versions prior to 5.10.11 are affected.\nImpact: Post-exploitation leads to a total compromise of the administrative interface. An attacker can hijack an administrator session, modify site content, execute arbitrary code if the administrative privileges permit file uploads or plugin management, and access sensitive database information.\nThe flaw illustrates a classic breakdown in state management and authorization boundary enforcement, where the transition from a verification token to an authenticated session state is not securely bound to the original authorization context."
}