Craft CMS improper authorization in user password reset

Executive brief

Craft CMS, a popular content management system, contains a vulnerability that allows authenticated users to change their own passwords without providing their current one. More critically, users with basic 'edit users' permissions can reset the passwords of any other user, including administrators. This could lead to a complete takeover of the website by an attacker with low-level access.

Technical details

A vulnerability in Craft CMS exists within the 'elements/save' action when processing User elements. The 'UserPasswordValidator' incorrectly applies a 'safe' validator to the 'newPassword' field without scenario restrictions, making it mass-assignable during generic element saves. This bypasses the 'users/set-password' action which normally enforces elevated session verification. An authenticated attacker with 'edit users' permissions can exploit this to change the password of any user, including administrators, while any authenticated user can change their own password without current password verification. The issue is patched in version 5.10.8.

Affected products

• Craft CMS CMS >= 5.0.0-RC1, < 5.10.8

Timeline

• 2026-07-25: patched: Fixed in version 5.10.8
• 2026-08-06: advisory: GitHub Advisory published

References

• https://api.github.com/users/mHe4am
• https://github.com/mHe4am
• https://api.github.com/users/mHe4am/gists%7B/gist_id%7D
• https://api.github.com/users/mHe4am/repos
• https://avatars.githubusercontent.com/u/138346620?v=4
• https://api.github.com/users/mHe4am/events%7B/privacy%7D