CVE-2026-79989
1 advisory.
Packagist/craftcms/cms CVE-2026-72786, CVE-2026-79989: high, EPSS 0.46%
Craft CMS: Arbitrary user password reset leading to administrator account takeover
Action: Upgrade craftcms/cms to 5.10.8 or later.
composer require craftcms/cms:5.10.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0-RC1 | 5.10.8 | - |
Fixed versions
| 5.10.8 |
Sources
- osv: GHSA-p8x7-9vfw-p7vc
- https://github.com/craftcms/cms/security/advisories/GHSA-p8x7-9vfw-p7vc
- https://github.com/craftcms/cms/commit/cbdf45fbd3ab548b147d7de375f6f6f580b7c294
- https://github.com/craftcms/cms
- https://github.com/craftcms/cms/releases/tag/5.10.8
CVE-2026-72786, CVE-2026-79989 · published · modified · JSON