CVE-2026-112775
7.5HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-287
Impact
Attackers can take over user accounts and reset passwords by reusing email verification codes. To exploit this, the attacker must intercept or obtain a victim's emailed code after the victim verifies an email change.
Root cause
The users/verify-email endpoint fails to invalidate verification codes for active users after use, allowing them to be resubmitted to users/set-password.
Affected systems
Craft CMS 5.0.0 before 5.11.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Craft CMS to version 5.11.0 or later. No interim mitigation is provided; upgrading is required to resolve the issue.
$ composer require craftcms/cms:"^5.11.0" --update-with-dependenciesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.