CVE-2026-79989

Craft CMS is affected by an arbitrary password reset vulnerability that can lead to administrator account takeover . Any authenticated user can change their own password without providing the current password or an active elevated session. Additionally, an attacker holding the Edit users permissi...