CVE-2026-86731

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.11

Description An authenticated control panel user with the administrateUsers permission can activate a pending or deactivated administrator account. This occurs because the UsersController::actionActivateUser() function (associated with the 'users/activate-user' endpoint) fails to call requireAdmin() when the target user is an administrator. This flaw can lead to permission escalation if the user also resets the password of the activated administrator account.

Recommendations Update Craft CMS to version 5.10.12.