# CVE-2026-84801: Craft CMS privilege escalation via administrateUsers permission

Source: https://junglewise.ai/threats/cve-2026-84801-craft-cms-privilege-escalation-via-administrateusers-permission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84801 · Severity: high · CVSS 8.8 · Published 2026-09-02

Craft CMS is a popular content management system used to build and manage websites. A vulnerability in versions before 5.10.11 allows non-administrator users with specific permissions to generate password reset links for admin accounts, then change those passwords to gain full control of the platform. This enables an attacker to take over the entire CMS and access sensitive website management functions.

## Quick answers

**Is CVE-2026-84801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84801 being exploited in the wild.

**How severe is CVE-2026-84801?** High severity, with a CVSS score of 8.8, published 2 September 2026.

**Which products and versions are affected?** Craft CMS 5.0.0-RC1 to 5.10.10.

**Is there a fix for CVE-2026-84801?** A patch was published on 2026-09-02: Fix available in version 5.10.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84801 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84801?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the actionGetPasswordResetUrl endpoint of UsersController. A non-admin user holding the administrateUsers permission can call this endpoint to generate a valid password reset URL for any user, including administrators. The root cause is the omission of an admin-status guard that exists in all other destructive sibling actions. The actionSetPassword endpoint then validates only the verification code in the reset URL with no session tie to the caller, allowing the attacker to set a new password for the admin account. No authentication or elevated session is required from the target admin. The vulnerability affects Craft CMS versions 5.0.0-RC1 through 5.10.10; version 5.10.11 includes the fix.

## Affected products

- Craft CMS 5.0.0-RC1 to 5.10.10

## Timeline

- 2026-08-18: disclosed: GitHub Security Advisory GHSA-6qw4-cjqw-fj72 published
- 2026-09-02: advisory: CVE-2026-84801 published on NVD
- 2026-09-02: patched: Fix available in version 5.10.11

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-6qw4-cjqw-fj72](https://github.com/craftcms/cms/security/advisories/GHSA-6qw4-cjqw-fj72)
- [https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-authentication-bypass-via-administrateusers](https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-authentication-bypass-via-administrateusers)