Advisory · CVE-2026-112775
Craft CMS verification codes survive email verification and can be reused to reset the password
Craft CMS 5.0.0 before 5.11.0 does not invalidate a verification code when an active user verifies an email change, so an attacker who obtains the code can reuse it at users/set-password to reset the victim's password and take over the account. CVSS 4.0 8.7 (CVSS 3.1 7.5).
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-112775
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The same emailed code opens two doors, and using it at the first door does not wear it out, so anyone who copied it can walk through the second door later.
- 01Email change started
An active user changes their account email and receives a verification code.
- 02Code obtained
An attacker obtains that code out of band, for example from a shared mailbox or logs.
- 03Victim verifies
The victim completes users/verify-email; for active users the code is not cleared.
- 04Password reset reuses code
The attacker submits the same code to users/set-password, resets the password, and takes over the account.
What happened
Craft CMS disclosed CVE-2026-112775 (CWE-287) for versions 5.0.0 before 5.11.0: one verification code authorizes both users/verify-email and users/set-password, but the verify-email path clears the code only for pending users. For an active user changing email, the code survives verification and remains valid for a full password reset.
The vendor advisory states the honest precondition: the attacker must obtain the victim’s code out of band, and the flow starts with an email change on an active account. Per the vendor affected data in the NVD record, 5.11.0 is the first unaffected release.
What to do
- Inventory Craft CMS sites on the 5.x line.
- Upgrade affected sites to 5.11.0 or later using the project release guidance.
- Hunt for email changes followed shortly by password resets on the same account, especially administrative accounts, and for verification codes appearing in logs or shared inboxes.
- Force password resets and session revocation for any account where that pattern cannot be explained.
- Verify the deployed version after updating, not just that an update ran.
Management note
Single-use codes are a promise users rely on when they complete a verification. Audit the email-change-to-reset pattern back to your log retention limit; any unexplained pair is a takeover until proven otherwise.