CVE-2026-112775 Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Attackers can reuse verification codes to reset passwords and take over accounts in Craft CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112775?
CVE-2026-112775 is a high-severity authentication bypass vulnerability in craftcms cms, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Weakness: CWE-287
Which versions are affected by CVE-2026-112775?
How do I fix CVE-2026-112775?
No fix has been published for CVE-2026-112775 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-112775 being exploited?
There is no known exploitation of CVE-2026-112775 in the wild and no public exploit code.
Sources
Also known as GHSA-5779-r722-9gx9, GHSA-xh42-494x-2xgv.