Executive brief
Craft CMS is a website content management platform that allows administrators to control user accounts and permissions. A non-administrator employee with the ability to manage users can activate a disabled administrator account without requiring administrator approval, then reset that account's password to gain full admin access. This circumvents the intended permission hierarchy and allows unauthorized privilege escalation.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the UsersController::actionActivateUser action. The action checks for administrateUsers permission but fails to call requireAdmin() when the target user is an administrator, unlike the symmetrical actionDeactivateUser action. An authenticated control panel user with administrateUsers permission (but not admin status) can POST to the users/activate-user endpoint with an admin user ID to activate a pending or deliberately deactivated administrator account. This can be chained with password reset functionality to achieve privilege escalation. The fix is available in Craft CMS 5.10.12 and later.
Affected products
- Craft CMS 5.0.0-RC1 through 5.10.11
Timeline
- 2026-08-25: disclosed: GHSA-jqf5-vfg6-8cx5 published
- 2026-09-08: advisory: CVE-2026-86731 published
- 2026: patched: Fixed in Craft CMS 5.10.12