Permission Escalation in Craft CMS by Craft

CVE-2026-86731

What is CVE-2026-86731?

Craft CMS versions 5.0.0-RC1 through 5.10.11 are susceptible to a permission escalation vulnerability. The flaw exists in the UsersController::actionActivateUser, where the action lacks an admin-target guard. Although it requires the administrateUsers permission, it fails to enforce admin status checks when targeting administrator accounts. This oversight enables non-admin users with the appropriate permissions to activate pending or intentionally disabled administrator accounts, particularly when combined with resetting that user’s password, leading to an escalation of control over the Craft CMS environment. The vulnerability is addressed in version 5.10.12.

References