high7.5
CVE-2026-112775
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email…
Impact
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Affected products
| Product | Affected versions |
|---|---|
| Craft CMS From 5.0.0 | before 5.11.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.