# CVE-2026-112775: Craft CMS verification code reuse allows account takeover

Source: https://junglewise.ai/threats/cve-2026-112775-craft-cms-from-5-0-0-before-5-11-0-contains-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112775 · Severity: high · CVSS 7.5 · Published 2026-10-19

Craft CMS, a website content management system, contains a flaw in how it validates one-time codes sent to users for email verification and password resets. An attacker who obtains a victim's verification code can use it twice: once after the victim legitimately verifies a new email address, and again to reset the password and take over the account. This means a single intercepted code grants full account access.

Technologies: [Craft CMS](https://junglewise.ai/threats/technologies/craft-cms-1). Vendors: [Craft](https://junglewise.ai/threats/vendors/craft).

## Quick answers

**Is CVE-2026-112775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112775 being exploited in the wild.

**How severe is CVE-2026-112775?** High severity, with a CVSS score of 7.5, published 19 October 2026.

**Which products and versions are affected?** Craft CMS 5.0.0 to 5.10.x.

**Is there a fix for CVE-2026-112775?** Yes: fixed in 5.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112775 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112775?** Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.11.0

## Technical details

The vulnerability is an authentication bypass due to incomplete verification code invalidation. The verify-email endpoint only clears the verification code for pending users; for active users changing their email, the code is promoted without invalidation. The same code is later accepted by the set-password endpoint, which correctly nulls it—but the victim's legitimate email verification does not consume it. An attacker with out-of-band access to the code (leaked mail, shared inbox, or logs) can reuse it for unauthorized password reset after the victim completes email verification.

## Affected products

- Craft CMS 5.0.0 to 5.10.x

## Timeline

- 2026-10-05: disclosed
- 2026-10-19: advisory

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv](https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv)
- [https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.0-verification-code-reuse-via-users-set-password](https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.0-verification-code-reuse-via-users-set-password)

## Related threats

- [Craft CMS SQL injection in craft.search](https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of)
- [Craft CMS authorization bypass in volume browser](https://junglewise.ai/threats/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization)
- [Craft CMS privilege escalation in public registration](https://junglewise.ai/threats/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege)
- [Craft CMS path traversal in app/icon-svg endpoint](https://junglewise.ai/threats/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file)
- [Craft CMS authorization bypass in GraphQL schema scope](https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization)