CVE-2026-79989

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-79989", "assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "state": "PUBLISHED", "assignerShortName": "Hackrate", "dateReserved": "2026-08-25T16:39:03.171Z", "datePublished": "2026-09-02T14:11:02.784Z", "dateUpdated": "2026-09-02T17:51:42.963Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "shortName": "Hackrate", "dateUpdated": "2026-09-02T14:11:02.784Z"}, "title": "Arbitrary user password reset leading to administrator account takeover", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "type": "CWE"}]}], "affected": [{"vendor": "craftcms", "product": "cms", "collectionURL": "https://packagist.org", "packageName": "craftcms/cms", "versions": [{"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.10.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0-rc1", "versionEndExcluding": "5.10.8"}]}]}], "descriptions": [{"lang": "en", "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has&nbsp;<code>Edit users</code>&nbsp;permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks&nbsp;<code>Administrate users</code>&nbsp;permission (which is required to change others\u2019 passwords).<br>"}]}], "references": [{"url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH", "tags": ["third-party-advisory", "technical-description", "mitigation"]}, {"url": "https://github.com/craftcms/cms/releases/tag/5.10.8", "tags": ["release-notes"]}, {"url": "https://github.com/craftcms/cms", "tags": ["product"]}, {"url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Mohammed Hesham (@he4am)", "type": "reporter"}, {"lang": "en", "value": "Hackrate", "type": "coordinator"}], "source": {"advisory": "GHSA-p8x7-9vfw-p7vc", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-02T17:51:36.553736Z", "id": "CVE-2026-79989", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T17:51:42.963Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-79989", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-02T17:51:36.553736Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T17:51:40.318Z"}}], "cna": {"title": "Arbitrary user password reset leading to administrator account takeover", "source": {"advisory": "GHSA-p8x7-9vfw-p7vc", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Mohammed Hesham (@he4am)"}, {"lang": "en", "type": "coordinator", "value": "Hackrate"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.10.8", "versionType": "semver"}], "packageName": "craftcms/cms", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH", "tags": ["third-party-advisory", "technical-description", "mitigation"]}, {"url": "https://github.com/craftcms/cms/releases/tag/5.10.8", "tags": ["release-notes"]}, {"url": "https://github.com/craftcms/cms", "tags": ["product"]}, {"url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords).", "supportingMedia": [{"type": "text/html", "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has&nbsp;<code>Edit users</code>&nbsp;permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks&nbsp;<code>Administrate users</code>&nbsp;permission (which is required to change others\u2019 passwords).<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.8", "versionStartIncluding": "5.0.0-rc1"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "shortName": "Hackrate", "dateUpdated": "2026-09-02T14:11:02.784Z"}}}, "cveMetadata": {"cveId": "CVE-2026-79989", "state": "PUBLISHED", "dateUpdated": "2026-09-02T17:51:42.963Z", "dateReserved": "2026-08-25T16:39:03.171Z", "assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "datePublished": "2026-09-02T14:11:02.784Z", "assignerShortName": "Hackrate"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "packageName": "craftcms/cms", "product": "cms", "vendor": "craftcms", "versions": [{"lessThan": "5.10.8", "status": "affected", "version": "5.0.0-RC1", "versionType": "semver"}]}], "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords)."}], "id": "CVE-2026-79989", "lastModified": "2026-09-09T15:41:24.427", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79989", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-02T17:51:36.553736Z", "version": "2.0.3"}}]}, "published": "2026-09-02T15:17:42.297", "references": [{"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/craftcms/cms"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/craftcms/cms/releases/tag/5.10.8"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH"}], "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-RC1,5.10.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "craftcms"}, "product": "cms", "vendor": "craftcms"}], "created": "2026-09-03T10:45:04.882416+00:00", "updated": "2026-09-03T12:15:03.941114+00:00", "vendors": ["craftcms", "craftcms$PRODUCT$cms"]}