GHSA-p8x7-9vfw-p7vcHigh▾ TwilightCraft CMS: Arbitrary user password reset leading to administrator account takeover
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
The vulnerability exists in the elements/save action when saving a User element. The UserPasswordValidator applies only a safe validator to the newPassword field without an on scenario restriction. This makes newPassword mass-assignable during the generic element save flow, completely bypassing the dedicated users/set-password action that enforces elevated session verification.
An attacker with any authenticated session (whether it’s hijacked or a normal / low-privileged user) can change their own password, and potentially take over administrator accounts.
craftcms/cms >= 5.0.0-RC1, < 5.10.8Upgrade to a patched release:
craftcms/cms 5.10.8Connected by shared product, vendor, weakness, or advisory.
GHSA-2rp4-x2j7-qmccMediumCraft CMS: Stored XSS in the control panel via unescaped draft name
CVE-2026-50279HighCraft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
CVE-2026-72786Medium· 6.5Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification
CVE-2026-32267HighCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
GHSA-xxpx-f366-4xpqMediumCraft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element
GHSA-wg23-69c2-gjc8CriticalCraft CMS: Passkey login accepts replayed WebAuthn assertions