Least Privilege Violation in Craft CMS - #VU159610
Published: November 6, 2026
Vulnerability identifier: #VU159610
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-272
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with an active account session to retain access after two-factor authentication is enabled and disable it without re-authentication.
The vulnerability exists due to missing session invalidation and re-authentication checks in Craft CMS account security settings when two-factor authentication is enabled or removed. An attacker with an active account session can continue using that session and remove the victim’s second factor without knowing their password or authentication codes.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - update to 5.11.4