CVE-2026-84801

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 5.10.11

Description Insufficient validation of administrator status in the 'actionGetPasswordResetUrl' endpoint allows non-admin users who possess the administrateUsers permission to generate password reset URLs for administrator accounts. An attacker can use these URLs to set a new password via the 'actionSetPassword' endpoint, which only verifies the code and does not check the caller's session, potentially leading to a complete takeover of the control panel.

Recommendations Update Craft CMS to version 5.10.11 or later.