Description
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.0.0-RC1 – < 5.10.11 | 5.10.11 |
References
- GitHub Security Advisory (GHSA-242m-9wq7-vhwq) vendor-advisory
- VulnCheck Advisory: Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance third-party-advisory