Improper Authorization in Craft CMS - #VU139971
Published: July 29, 2026
Vulnerability details
The vulnerability allows a remote user to reset passwords for their own account and other users' accounts, potentially leading to administrator account takeover.
The vulnerability exists due to improper authorization in the elements/save action when saving a User element, because the UserPasswordValidator makes the newPassword field mass-assignable without scenario restriction when processing element save requests. A remote user can send a specially crafted request to reset passwords for their own account and other users' accounts, potentially leading to administrator account takeover.
Exploitation requires an authenticated session with access to the control panel, and changing other users' passwords additionally requires the Edit users permission.