Authentication Bypass in Craft CMS by Craft

CVE-2026-84795

What is CVE-2026-84795?

Craft CMS prior to version 5.10.11 is susceptible to an authentication bypass vulnerability due to inadequate validation of the admin flag during user registration. This flaw allows malicious users to register accounts using the email addresses of deactivated admin accounts. If public registration is enabled and email verification is disabled, attackers can effectively obtain administrative privileges, posing significant security risks to the affected installations.

References