CVE-2026-79989

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

CVSS

No CVSS.

References

Link	Resource
https://github.com/advisories/GHSA-p8x7-9vfw-p7vc
https://github.com/craftcms/cms
https://github.com/craftcms/cms/releases/tag/5.10.8
https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-02 15:17

Updated : 2026-09-09 15:41

NVD link : CVE-2026-79989

Mitre link : CVE-2026-79989

CVE.ORG link : CVE-2026-79989

JSON object : View

Products Affected

No product.

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-79989", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79989", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-02T17:51:36.553736Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "affectedData": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.10.8", "versionType": "semver"}], "packageName": "craftcms/cms", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}]}], "published": "2026-09-02T15:17:42.297", "references": [{"url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://github.com/craftcms/cms", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://github.com/craftcms/cms/releases/tag/5.10.8", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}, {"url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords)."}], "lastModified": "2026-09-09T15:41:24.427", "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}

CVE-2026-79989

JSON object

Attach tags to CVE-2026-79989

Attach tags to `CVE-2026-79989`