Is CVE-2026-86731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86731 being exploited in the wild.

How severe is CVE-2026-86731?

Medium severity, with a CVSS score of 6.5, published 8 September 2026.

Which products and versions are affected?

Craft CMS 5.0.0-RC1 through 5.10.11.

Is there a fix for CVE-2026-86731?

A patch was published on 2026: Fixed in Craft CMS 5.10.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86731 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86731?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86731: Craft CMS missing admin-target guard in user activation

CVE-2026-86731 · Severity: medium · CVSS 6.5 · Published 2026-09-08

Craft CMS is a website content management platform that allows administrators to control user accounts and permissions. A non-administrator employee with the ability to manage users can activate a disabled administrator account without requiring administrator approval, then reset that account's password to gain full admin access. This circumvents the intended permission hierarchy and allows unauthorized privilege escalation.

Quick answers

Is CVE-2026-86731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86731 being exploited in the wild.
How severe is CVE-2026-86731?: Medium severity, with a CVSS score of 6.5, published 8 September 2026.
Which products and versions are affected?: Craft CMS 5.0.0-RC1 through 5.10.11.
Is there a fix for CVE-2026-86731?: A patch was published on 2026: Fixed in Craft CMS 5.10.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86731 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86731?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the UsersController::actionActivateUser action. The action checks for administrateUsers permission but fails to call requireAdmin() when the target user is an administrator, unlike the symmetrical actionDeactivateUser action. An authenticated control panel user with administrateUsers permission (but not admin status) can POST to the users/activate-user endpoint with an admin user ID to activate a pending or deliberately deactivated administrator account. This can be chained with password reset functionality to achieve privilege escalation. The fix is available in Craft CMS 5.10.12 and later.

Affected products

Craft CMS 5.0.0-RC1 through 5.10.11

Timeline

2026-08-25: disclosed: GHSA-jqf5-vfg6-8cx5 published
2026-09-08: advisory: CVE-2026-86731 published
2026: patched: Fixed in Craft CMS 5.10.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.