Craft CMS (5.0.0-5.11.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/craft-cms-5.0.0-5.11.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 17:30:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCraft CMS: Unauthenticated privilege escalation (CVE-2026-124429)https://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation-eb683e16/Sun, 08 Nov 2026 17:30:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation-eb683e16/Craft CMS versions 5.0.0 through 5.11.1 contain a privilege escalation vulnerability that allows unauthenticated attackers to hijack deactivated accounts and inherit existing user permissions when email verification is disabled.Craft CMS versions 5.0.0 through 5.11.1 are susceptible to a privilege escalation vulnerability (CVE-2026-124429). The issue occurs when public registration is enabled and email verification is disabled. An attacker can register an account using the identifier of a previously deactivated non-admin account. The application fails to properly re-validate the account status, allowing the newly registered user to inherit existing permissions stored in the userpermissions_users database table.

Impact

Successful exploitation allows an unauthenticated attacker to perform account takeover of previously deactivated non-admin accounts and gain access to the permissions associated with those accounts.

Recommendation

  • Update Craft CMS to version 5.11.2 or later immediately.
  • If patching is delayed, enable email verification for new account registrations to prevent the exploitation of deactivated accounts.
  • Review the userpermissions_users database table for accounts with suspicious recent registration dates that retain elevated permissions.
]]>highadvisory