Advisory · CVE-2026-124429
Craft CMS lets strangers reclaim deactivated accounts and keep their permissions
Craft CMS 5.0.0 before 5.11.2 contains a privilege escalation flaw that lets unauthenticated public registrants reclaim deactivated non-admin accounts while retaining their direct permissions, enabling privileged account takeover when email verification is disabled, rated high at CVSS 8.7 under version 4.0; fixed in 5.11.2.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-124429
CWE-266 - Action timing
- Immediate
Explain it like I’m five
When an account is switched off, its keys are supposed to stop working. Craft CMS lets a stranger sign up using a switched-off account's name, set a new password, and walk in with the old account's permissions still attached.
- 01Deactivated account exists
A non-admin account has been deactivated but its direct permissions remain stored.
- 02Public registration
An unauthenticated attacker registers using the deactivated account's identity.
- 03New password set
The attacker sets a fresh password during registration.
- 04Permissions inherited
The new account keeps the direct permissions stored for the old account.
- 05Privileged access
The attacker uses those permissions inside the control panel.
What happened
Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation flaw that allows unauthenticated public registrants to reclaim deactivated non-admin accounts while retaining their direct permissions. Attackers can register using a deactivated account, set a new password, and inherit permissions stored in userpermissions_users, enabling privileged account takeover when email verification is disabled. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.
Deactivation is supposed to be an off switch, and this flaw turns it into a spare key. The flaw is fixed in Craft CMS 5.11.2.
What to do
- Inventory Craft CMS deployments and record each version.
- Upgrade to Craft CMS 5.11.2 or later.
- Audit user accounts for registrations that reused deactivated identities.
- Review permissions granted to recently registered accounts.
- Confirm email verification is enabled for public registration.
- Disable or remove any account that cannot be accounted for and rotate its credentials.
- Verify the deployed version after updating.
Management note
Account deactivation that leaves permissions behind is a quiet privilege escalation path. Check who registered recently before assuming the patch closes the incident.