{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/craft-cms-5.0.0-5.11.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-124429"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Craft CMS (5.0.0-5.11.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Craft CMS"],"content_html":"\u003cp\u003eCraft CMS versions 5.0.0 through 5.11.1 are susceptible to a privilege escalation vulnerability (CVE-2026-124429). The issue occurs when public registration is enabled and email verification is disabled. An attacker can register an account using the identifier of a previously deactivated non-admin account. The application fails to properly re-validate the account status, allowing the newly registered user to inherit existing permissions stored in the userpermissions_users database table.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to perform account takeover of previously deactivated non-admin accounts and gain access to the permissions associated with those accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Craft CMS to version 5.11.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is delayed, enable email verification for new account registrations to prevent the exploitation of deactivated accounts.\u003c/li\u003e\n\u003cli\u003eReview the userpermissions_users database table for accounts with suspicious recent registration dates that retain elevated permissions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T17:30:07Z","date_published":"2026-11-08T17:30:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation-eb683e16/","summary":"Craft CMS versions 5.0.0 through 5.11.1 contain a privilege escalation vulnerability that allows unauthenticated attackers to hijack deactivated accounts and inherit existing user permissions when email verification is disabled.","title":"Craft CMS: Unauthenticated privilege escalation (CVE-2026-124429)","url":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation-eb683e16/"}],"language":"en","title":"CraftedSignal Threat Feed - Craft CMS (5.0.0-5.11.1)","version":"https://jsonfeed.org/version/1.1"}