Auth bypass in Craftcms Cms
CVE-2026-29069
Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.003 (19.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Craftcms Cms — versions >= 5.0.0-RC1, < 5.9.0-beta.2, >= 4.0.0-RC1, < 4.17.0-beta.2
- Craftcms Craft_cms — versions 4.0.0, 4.17.0, 5.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-29069?
- CVE-2026-29069 is a medium-severity vulnerability in Craftcms Cms, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.3/10. Published 2026-03-04.
- How severe is CVE-2026-29069?
- Medium severity. CVSS v3 base score is 5.3 out of 10.