Authorization bypass through user-controlled key in Craft CMS - CVE-2026-29069

Detailed vulnerability description

The vulnerability allows a remote attacker to trigger activation emails for arbitrary pending user accounts and potentially gain access to the system.

The vulnerability exists due to improper access control in the actionSendActivationEmail() endpoint when handling user-supplied userId parameters for pending users. A remote attacker can send a specially crafted request with an arbitrary user ID to trigger activation emails for arbitrary pending user accounts and potentially gain access to the system.

If the attacker controls the target user's email address, the activation flow can be completed to access the account. The endpoint responses can also reveal whether a user ID exists and whether the account is pending or active.

How to mitigate CVE-2026-29069

Sources

• https://github.com/craftcms/cms/security/advisories/GHSA-234q-vvw3-mrfq
• https://github.com/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8