CVE-2026-86731

Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

State: Published
Severity: 7.1 High
Published: Sep 8, 2026
Updated: Sep 19, 2026
Reserved: Sep 8, 2026

Description

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an administrator, unlike the mirror action actionDeactivateUser. As a result, an authenticated control panel user who is not an administrator but holds the administrateUsers permission can activate a pending or deliberately deactivated administrator account, which can lead to permission escalation when combined with resetting that account's password. The issue is fixed in Craft CMS 5.10.12.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
cmscraftcms	5.0.0-RC1 to before 5.10.12Affected 5.10.12Not affected

References

GitHub Security Advisory (GHSA-jqf5-vfg6-8cx5)vendor-advisory
VulnCheck Advisory: Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersControllerthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.