SB2026072925 - Multiple vulnerabilities in Craft CMS
Published: July 29, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Improper Authorization (CVE-ID: N/A)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to reset passwords for their own account and other users' accounts, potentially leading to administrator account takeover.
The vulnerability exists due to improper authorization in the elements/save action when saving a User element, because the UserPasswordValidator makes the newPassword field mass-assignable without scenario restriction when processing element save requests. A remote user can send a specially crafted request to reset passwords for their own account and other users' accounts, potentially leading to administrator account takeover.
Exploitation requires an authenticated session with access to the control panel, and changing other users' passwords additionally requires the Edit users permission.
2) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in a higher-privileged user's control-panel session.
The vulnerability exists due to cross-site scripting in the control-panel helper that renders element chip/card labels when rendering an element's draft name without HTML encoding. A remote user can create a draft with a crafted draft name to execute arbitrary JavaScript in a higher-privileged user's control-panel session.
User interaction is required because a higher-privileged control-panel user must be shown the affected element's chip or card in the control panel.
Remediation
Install update from vendor's website.