Lucene search
+L

2436 matches found

CVE
CVE
added 2026/09/02 11:11 a.m.13 views

CVE-2026-84801

Craft CMS versions from 5.0.0-RC1 up to 5.10.11 are affected by an authentication bypass in the actionGetPasswordResetUrl endpoint, which fails to validate the caller's admin status. A non-admin user holding the administrateUsers permission can mint a password-reset URL for any administrator acco...

8.8CVSS5.9AI score0.00246EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 11:11 a.m.29 views

CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

8.8CVSS0.00246EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/02 11:11 a.m.9 views

EUVD-2026-69913

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

8.8CVSS5.9AI score0.00246EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/02 11:11 a.m.4 views

CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

8.7CVSS5.9AI score
SaveExploits0References4
EUVD
EUVD
added 2026/09/02 11:11 a.m.8 views

EUVD-2026-69912

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

7.1CVSS5.9AI score0.00202EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/02 11:11 a.m.13 views

CVE-2026-84800

Craft CMS versions >= 5.0.0-RC1 and

7.1CVSS5.9AI score0.00202EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/02 11:11 a.m.4 views

CVE-2026-84800 Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

7.1CVSS5.9AI score
SaveExploits0References4
EUVD
EUVD
added 2026/09/02 11:11 a.m.8 views

EUVD-2026-69911

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

5.3CVSS5.9AI score0.00168EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/02 11:11 a.m.8 views

CVE-2026-84799

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relation fields including author , authors , uploader , draftCreator , and revisionCreator . An attacker holding a scoped GraphQL token can query these relations to read the usernames, email addresses, and fu...

5.3CVSS5.9AI score0.00168EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 11:11 a.m.37 views

CVE-2026-84799 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

5.3CVSS0.00168EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 11:11 a.m.34 views

CVE-2026-84800 Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

7.1CVSS0.00202EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 11:11 a.m.34 views

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

7.1CVSS0.00202EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/02 11:11 a.m.8 views

EUVD-2026-69910

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

7.1CVSS5.8AI score0.00202EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/02 11:11 a.m.4 views

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

7.1CVSS5.8AI score
SaveExploits0References4
CVE
CVE
added 2026/09/02 11:11 a.m.10 views

CVE-2026-84798

Craft CMS versions 5.0.0-RC1 through 5.10.10 contain an authorization bypass in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and performs the deletion authorization check only against the user's own provisional draft (verifying draft...

7.1CVSS5.8AI score0.00202EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/02 11:11 a.m.8 views

EUVD-2026-69908

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

8.8CVSS5.8AI score0.00261EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 11:11 a.m.31 views

CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

8.8CVSS0.00261EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/02 11:11 a.m.9 views

CVE-2026-84797

Craft CMS versions 5.0.0-RC1 through before 5.10.11 are affected by an authorization bypass in ElementsController::actionDuplicate(). The vulnerability stems from missing authorization checks on the deleteProvisionalDraft parameter, allowing any authenticated user holding the createEntries permis...

6.3CVSS5.9AI score0.00169EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/02 11:11 a.m.7 views

EUVD-2026-69909

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

6.3CVSS5.9AI score0.00169EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/02 11:11 a.m.5 views

CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

5.3CVSS5.9AI score
SaveExploits0References4
Rows per page
Query Builder