CVE-2026-86731 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations, particularly those with user management and permission systems, should assess exposure and apply the patch. They should also review user permissions to prevent exploitation and monitor relevant logs for exposed assets. Additionally, defenders should track exceptions and retest remediated assets, and check asset inventory for affected systems.

Why it matters

CVE-2026-86731 is a permission escalation vulnerability in Craft CMS that allows an authenticated control panel user to activate a pending or deactivated administrator account. Defenders should verify exposure, apply the patch, and review user permissions to prevent exploitation.

• Permission escalation can occur when an authenticated control panel user activates a pending or deactivated administrator account.
• Verification of user permissions and Craft CMS versions is necessary to determine exposure.
• Applying the patch and restricting user permissions can prevent exploitation.

Technical summary

The vulnerability is caused by a missing admin-target guard in UsersController::actionActivateUser. An authenticated control panel user with the administrateUsers permission can activate a pending or deactivated administrator account, leading to permission escalation. The issue is fixed in Craft CMS 5.10.12. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. Defenders should prioritize verifying exposure and applying the patch to prevent exploitation. The vulnerability affects Craft CMS versions 5.0.0-RC1 through 5.10.11.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as this vulnerability allows for permission escalation.

Recommended defensive actions

• Verify exposure by checking Craft CMS versions and user permissions
• Apply the patch by upgrading to Craft CMS 5.10.12
• Review and restrict user permissions to prevent exploitation
• Monitor relevant logs for exposed assets that need extra review
• Track exceptions and retest remediated assets
• Check asset inventory for affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. However, there is limited information on exploitation or victim impact. Defenders should verify exposure by checking Craft CMS versions and user permissions, apply the patch by upgrading to Craft CMS 5.10.12, and review user permissions to prevent exploitation. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.