Authentication Bypass Vulnerability in Craft CMS by Pixel & Tonic

CVE-2026-79989

What is CVE-2026-79989?

Craft CMS contains a vulnerability that enables any authenticated user to reset their password without the need to provide the current password or maintain an active elevated session. Furthermore, if an attacker’s account is granted the 'Edit users' permission but lacks the 'Administrate users' permission, they can exploit this flaw to change the passwords of other users. This raises significant security concerns as it circumvents standard authentication measures, placing user accounts at risk.

References