CVE-2026-29069: 
PHP vulnerability analysis and mitigation

CVE-2026-29069 is an authorization bypass vulnerability in Craft CMS that allows unauthenticated attackers to trigger account activation emails for any pending user account by supplying an arbitrary userId parameter to the actionSendActivationEmail() endpoint. The vulnerability affects Craft CMS versions >= 4.0.0-RC1 and < 4.17.0-beta.2, and >= 5.0.0-RC1 and < 5.9.0-beta.2. It was published on March 3–4, 2026, and patched in versions 4.17.0-beta.2 and 5.9.0-beta.2. The CVSS v3.1 base score is 5.3 (Medium), while the GitHub Advisory Database rates it as High (CVSS v4 score of 7.8) (Github Advisory, Craft CMS Advisory).

The root cause is an authorization bypass through a user-controlled key (CWE-639) combined with improper authentication (CWE-287). The actionSendActivationEmail() endpoint was intentionally listed in the allowAnonymous array to support self-service activation email resends, but it accepted an arbitrary userId body parameter ($userId = $this->request->getRequiredBodyParam('userId');) without verifying that the requesting party owns or is associated with that account. Any unauthenticated visitor could POST to /actions/users/send-activation-email with any valid user ID to trigger an activation email for that account. The fix (commit c3d02d4) removed send-activation-email from allowAnonymous and introduced a userActionChecks() method that enforces a POST request, a Control Panel request origin, and the editUsers permission (Craft CMS Advisory, Patch Commit).

The primary impact is unauthorized account activation: if an attacker controls or has access to a pending user's email address (via compromise, typosquatting, or shared mailbox), they can trigger the activation link, set a password, and gain full access to the Craft CMS system with whatever permissions were pre-assigned to that account. A secondary impact is user enumeration — differing API responses ("Activation email sent", "User not found", "Activation emails can only be sent to inactive or pending users") allow attackers to map all user IDs and their account states without authentication. Additionally, the endpoint can be abused for email spam or harassment by repeatedly triggering activation emails to pending users (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.067%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires no authentication and no user interaction, making it trivially exploitable if a precondition (attacker control of the target email) is met.

1. Reconnaissance: Identify a Craft CMS instance running a vulnerable version (4.0.0-RC1 through < 4.17.0-beta.2, or 5.0.0-RC1 through < 5.9.0-beta.2) using tools like Shodan, Censys, or by inspecting HTTP response headers and CMS fingerprints.
2. User ID enumeration: Send sequential POST requests to /actions/users/send-activation-email with incrementing userId values. Analyze response messages: "Activation email sent" indicates a pending user; "User not found" indicates no such user; "Activation emails can only be sent to inactive or pending users" indicates an active user.
3. Optional — GraphQL enumeration: If the Craft CMS instance exposes a public GraphQL endpoint, query { users { id email status } } to directly retrieve user IDs, emails, and statuses, filtering for pending accounts.
4. Identify a target: Select a pending user account whose email address the attacker controls (e.g., via email compromise, typosquatting domain, or shared mailbox).
5. Trigger activation email: Send a crafted POST request: POST /actions/users/send-activation-email with body userId=<target_id>. The server sends an activation email to the pending user's address.
6. Account takeover: Access the attacker-controlled email inbox, click the activation link, set a new password, and log in to Craft CMS with the permissions pre-assigned to the activated account (Github Advisory, Craft CMS Advisory).

• Network: Repeated POST requests to /actions/users/send-activation-email from unauthenticated sources or unfamiliar IP addresses; sequential or automated patterns of userId values in request bodies suggesting enumeration.
• Logs: Web server or Craft CMS application logs showing multiple POST /actions/users/send-activation-email requests from the same IP or user-agent with varying userId parameters; log entries showing "Activation email sent" responses for accounts not recently self-registered.
• Email: Unexpected activation emails delivered to user accounts that were not recently created or that users did not request; multiple activation emails sent to the same address in a short time window.
• Application: New user sessions appearing for accounts that were in a pending state for an extended period, particularly if the activation timestamp does not align with expected user behavior (Github Advisory).

Upgrade Craft CMS to version 4.17.0-beta.2 or later (for the 4.x branch) or 5.9.0-beta.2 or later (for the 5.x branch). The patch removes send-activation-email from the allowAnonymous list and enforces authentication, a Control Panel request origin, and the editUsers permission via the new userActionChecks() method. If immediate patching is not possible, implement network-level or WAF rules to block unauthenticated POST requests to /actions/users/send-activation-email, review all pending user accounts for suspicious activation activity, and monitor logs for enumeration patterns (Craft CMS Advisory, Patch Commit).