CVE-2026-72786: 
Craft CMS vulnerability analysis and mitigation

CVE-2026-72786 is an improper authorization (authentication bypass) vulnerability in Craft CMS that allows authenticated users to change passwords without verification, potentially enabling administrator account takeover. It affects Craft CMS versions from 5.0.0-RC1 up to (but not including) 5.10.8, and was published on August 12, 2026. The vulnerability was originally disclosed under GHSA-p8x7-9vfw-p7vc by researcher mHe4am on July 25, 2026. It carries a CVSS v3.1 base score of 6.5 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Craft CMS Advisory).

The root cause is CWE-285 (Improper Authorization) in the elements/save action of Craft CMS. The UserPasswordValidator applies only a safe validator to the newPassword field without an on scenario restriction, making newPassword mass-assignable during the generic element save flow. This completely bypasses the dedicated users/set-password action, which is designed to enforce elevated session verification before allowing password changes. As a result, any authenticated user can submit a crafted POST request to elements/save with a newPassword parameter targeting any user's account, including administrators, without needing to supply the current password or hold an elevated session (Craft CMS Advisory, GitHub Advisory).

Any authenticated Craft CMS user can change their own password without providing their current password, bypassing standard account security controls. More critically, users who hold the "Edit users" permission (but not the higher "Administrate users" permission) can reset the passwords of any other user account, including administrators, enabling full account takeover. Successful exploitation could lead to complete compromise of the Craft CMS instance, unauthorized access to all managed content, and potential lateral movement if administrator credentials are reused elsewhere (Craft CMS Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.327% (26th percentile), indicating a low but non-negligible probability of exploitation within 30 days. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, as it requires a low-privileged authenticated session. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain authenticated access: Log in to the Craft CMS control panel with any low-privileged account that has the "Edit users" permission. This could be a legitimately provisioned account or a hijacked session.
2. Identify target user: Browse the user list in the control panel to identify the target account (e.g., an administrator) and note their user element ID.
3. Craft malicious POST request: Construct a POST request to the elements/save action endpoint (e.g., /admin/actions/elements/save) including the target user's element ID and a newPassword field set to an attacker-controlled value, bypassing the normal users/set-password flow.
4. Submit the request: Send the crafted request using a tool such as Burp Suite or curl. Because newPassword is mass-assignable without scenario restriction, the CMS accepts and applies the new password without requiring the current password or elevated session verification.
5. Log in as the target user: Use the newly set password to authenticate as the target administrator account, achieving full account takeover (Craft CMS Advisory).

• Logs: Craft CMS application logs showing POST requests to actions/elements/save with a newPassword parameter for user elements other than the authenticated user's own account; unexpected password change events in the CMS audit log for administrator or high-privilege accounts.
• Network: HTTP POST traffic to /actions/elements/save or equivalent control panel endpoints originating from low-privileged user sessions, particularly targeting user element IDs belonging to administrators.
• Behavioral: Administrator accounts being locked out or reporting unexpected password invalidation; low-privileged users accessing the control panel immediately after an administrator password change event.

The primary remediation is to upgrade Craft CMS to version 5.10.8 or later, which patches the newPassword mass-assignment vulnerability in the elements/save action (Craft CMS Advisory). As an interim workaround, restrict the "Edit users" permission to only fully trusted administrators, minimizing the pool of accounts that could exploit the account takeover scenario. Additionally, implement monitoring and alerting for unexpected password change events in the Craft CMS audit log, particularly for administrator accounts (Feedly).

The vulnerability was reported by researcher mHe4am and disclosed via the Craft CMS GitHub security advisory program. No significant public commentary, media coverage, or notable researcher reactions beyond the initial advisory have been identified at this time (Craft CMS Advisory).