CVE-2026-29069

Опубликовано: 04 мар. 2026

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.

Ссылки

https://github.com/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8
Patch
https://github.com/craftcms/cms/security/advisories/GHSA-234q-vvw3-mrfq
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*

Версия от 4.0.0 (исключая) до 4.17.0 (исключая)

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*

Версия от 5.0.0 (исключая) до 5.9.0 (исключая)

cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*

cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*

cpe:2.3:a:craftcms:craft_cms:4.17.0:beta1:*:*:*:*:*:*

cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*

cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:craftcms:craft_cms:5.9.0:beta1:*:*:*:*:*:*

EPSS

Процентиль: 19%

0.00273

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-639

Связанные уязвимости

GHSA-234q-vvw3-mrfq

github

5 месяцев назад

Craft CMS has unauthenticated activation email trigger with potential user enumeration