CVE-2026-112775 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations, security teams, and administrators of affected systems should be aware of this vulnerability and take necessary actions to mitigate the risk.

Why it matters

CVE-2026-112775 is a high-severity authentication bypass vulnerability in Craft CMS that allows attackers to reuse verification codes to gain unauthorized access to user accounts. Defenders should prioritize verifying and upgrading to version 5.11.0 or later, and implement additional monitoring for suspicious account activity.

• Potential unauthorized access to user accounts
• Possible lateral movement within affected systems
• Need for verification and upgrade to version 5.11.0 or later
• Potential data breaches or account takeovers

Technical summary

The vulnerability allows attackers to reuse verification codes to bypass authentication in Craft CMS versions 5.0.0 before 5.11.0. This is possible because the users/verify-email endpoint does not invalidate verification codes for active users, allowing an attacker to use a victim's verification code to reset their password and gain unauthorized access to their account. The vulnerability has a high severity with a CVSS score of 8.7. Defenders should prioritize verifying and upgrading to version 5.11.0 or later, and implement additional monitoring for suspicious account activity.

Defensive priority

Defenders should prioritize verifying and upgrading to version 5.11.0 or later, and implement additional monitoring for suspicious account activity.

Recommended defensive actions

• Verify and upgrade to Craft CMS version 5.11.0 or later
• Monitor for suspicious account activity and implement additional security measures
• Review and update incident response plans to address potential authentication bypass
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation and affected systems is limited. Defenders should verify the vulnerability's existence and scope, review the official advisory or CVE record, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. The CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment. However, there is limited information on potential data breaches or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.