GHSA-P8X7-9VFW-P7VC: Arbitrary User Password Reset via Mass Assignment in Craft CMS
Vulnerability ID: GHSA-P8X7-9VFW-P7VC
CVSS Score: 8.8
Published: 2026-08-06
A high-severity authorization bypass vulnerability in Craft CMS allows authenticated users to reset arbitrary user passwords, including administrator accounts, by exploiting a mass assignment vulnerability in the User element model.
TL;DR
A mass assignment flaw in Craft CMS's User model allows authenticated users to modify sensitive internal properties, including password and lockout fields, bypassing security controls to achieve full administrator takeover.
Technical Details
- CWE ID: CWE-915
- Attack Vector: Network
- CVSS v3.1 Score: 8.8
- Exploit Status: none
- KEV Status: not listed
Affected Systems
- Craft CMS
Mitigation Strategies
- Upgrade Craft CMS to version 5.10.8 or later.
- Disable public profile updating controllers if not strictly required.
- Audit custom elements for mass assignment vulnerabilities.
Remediation Steps:
- Verify the current Craft CMS version.
- Update the composer.json file to require craftcms/cms: >=5.10.8.
- Run 'composer update craftcms/cms' to pull the patched version.
- Deploy the updated composer.lock file and verify successful deployment in production.
References
Read the full report for GHSA-P8X7-9VFW-P7VC on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)