critical9.8
CVE-2026-84795
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts.
Impact
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
Affected products
| Product | Affected versions |
|---|---|
| Craft CMS | before 5.10.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.