Unauthenticated Access in Craft CMS Allows Exploitation of User Activation Process
CVE-2026-29069

6.9MEDIUM

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
4 March 2026

What is CVE-2026-29069?

Craft CMS contains a vulnerability where the actionSendActivationEmail() endpoint is accessible without authentication for pending users. This allows an unauthorized attacker to trigger activation emails for any pending user account if they can guess the user ID. If they have control over the target user's email address, they can successfully activate the account, gaining access to the system. This flaw has been addressed in versions 5.9.0-beta.2 and 4.17.0-beta.2, emphasizing the importance of updating to secure user accounts.

Affected Version(s)

cms >= 5.0.0-RC1, < 5.9.0-beta.2 < 5.0.0-RC1, 5.9.0-beta.2

cms >= 4.0.0-RC1, < 4.17.0-beta.2 < 4.0.0-RC1, 4.17.0-beta.2

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/c3d02d4a7246f51693...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.