CVE-2026-112775

CVSS 8.7 (high) · published 2026-10-19

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.

Weakness: CWE-287

Source: NVD CVE-2026-112775

References

• https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv
• https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.0-verification-code-reuse-via-users-set-password

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.