Key points
- Craft CMS versions 5.0.0 through 5.10.x contain a high-severity authentication bypass.
- The flaw allows attackers to reuse verification codes to reset user passwords.
- Upgrading to version 5.11.0 resolves the issue by invalidating codes for active users.
Craft CMS administrators must update installations running version 5.0.0 or later but earlier than 5.11.0. The National Vulnerability Database records this issue as CVE-2026-112775. The flaw allows attackers to bypass authentication checks. This affects any site using the vulnerable range of the content management system.
In plain English
The vulnerability exists in how the system handles email verification codes. When a user changes their email address, the system sends a code to confirm the new address. In affected versions, the system fails to invalidate that code once the user completes the verification step. This means the code remains active even after the email change is confirmed.
The background
An attacker who intercepts or obtains this emailed verification code can exploit the flaw. According to the NVD record, the attacker can submit the code to the password reset endpoint. This action resets the victim’s password. The attacker then gains full control of the account. The weakness is classified under CWE-287, which relates to improper authentication mechanisms.
What changes now
Version 5.11.0 of Craft CMS addresses this problem. The updated software ensures that verification codes are invalidated for active users immediately after use. This prevents the reuse of codes for unauthorized password resets. Users running versions prior to 5.11.0 remain exposed to this account takeover risk.
Who needs to act first
Teams should prioritize systems exposed to the public internet. Check whether external-facing sites use the vulnerable CMS versions. Roll out the update to these high-exposure systems first. Test the update in a staging environment to ensure site stability. Back up databases before applying changes to production servers. Monitor login attempts for unusual activity during the patching process.
What to do and how to stay safe: Craft CMS
- Verify the current Craft CMS version on all managed servers and staging environments.
- Schedule an immediate update to version 5.11.0 or later for all vulnerable instances.
- Review recent logs for failed password reset attempts or unusual account changes.
- Force password resets for administrators if there is suspicion of compromise.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-112775 as 8.7, which is considered HIGH severity.
Which specific versions of Craft CMS are affected?
Versions from 5.0.0 up to, but not including, 5.11.0 are affected by this authentication bypass.
How does an attacker exploit this flaw?
Attackers reuse a victim's email verification code to reset their password and take over the account.
