CVE-2026-112775

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.x

Description An authentication bypass exists where verification codes are not invalidated for active users after use. An attacker who obtains a verification code sent via email can submit it to the 'users/set-password' endpoint after the victim has already verified an email change. This allows the attacker to reset the password and take over the account. The issue occurs because the 'users/verify-email' endpoint fails to properly invalidate the code.

Recommendations Update Craft CMS to version 5.11.0 or later.