{"action":"Upgrade craftcms/cms to 4.17.0-beta.2 or later.","affected":[{"fixed":"5.9.0-beta.2","introduced":"5.0.0-RC1"},{"fixed":"4.17.0-beta.2","introduced":"4.0.0-RC1"}],"component":"craftcms/cms","cve_ids":["CVE-2026-29069"],"ecosystem":"Packagist","epss":0.00317,"exploited":false,"fixed_versions":["5.9.0-beta.2","4.17.0-beta.2"],"ghsa_id":"GHSA-234q-vvw3-mrfq","id":"tcs_01M5KEREX99BH9AWJNX3HXZ1KQ","modified_at":"2026-03-04T21:11:18.468652Z","published_at":"2026-03-04T20:52:31Z","references":["https://osv.dev/vulnerability/GHSA-234q-vvw3-mrfq","https://github.com/craftcms/cms/security/advisories/GHSA-234q-vvw3-mrfq","https://nvd.nist.gov/vuln/detail/CVE-2026-29069","https://github.com/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8","https://github.com/craftcms/cms"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-234q-vvw3-mrfq","url":"https://osv.dev/vulnerability/GHSA-234q-vvw3-mrfq"},{"source":"nvd","source_id":"CVE-2026-29069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29069"}],"summary":"Craft CMS has unauthenticated activation email trigger with potential user enumeration"}