Craft CMS: Unauthenticated privilege escalation (CVE-2026-124429)

Craft CMS versions 5.0.0 through 5.11.1 are susceptible to a privilege escalation vulnerability (CVE-2026-124429). The issue occurs when public registration is enabled and email verification is disabled. An attacker can register an account using the identifier of a previously deactivated non-admin account. The application fails to properly re-validate the account status, allowing the newly registered user to inherit existing permissions stored in the userpermissions_users database table.

Impact

Successful exploitation allows an unauthenticated attacker to perform account takeover of previously deactivated non-admin accounts and gain access to the permissions associated with those accounts.

Recommendation

• Update Craft CMS to version 5.11.2 or later immediately.
• If patching is delayed, enable email verification for new account registrations to prevent the exploitation of deactivated accounts.
• Review the userpermissions_users database table for accounts with suspicious recent registration dates that retain elevated permissions.