CVE-2026-29069

MEDIUM EPSS 19.0%
Published Mar 4, 20263mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Mar 4, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
19.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-639

Affected Products 10

VendorProductVersionRange
craftcmscraft_cms*>4.0.0  –  <4.17.0
craftcmscraft_cms*>5.0.0  –  <5.9.0
craftcmscraft_cms4.0.0any
craftcmscraft_cms4.0.0any
craftcmscraft_cms4.0.0any
craftcmscraft_cms4.0.0any
craftcmscraft_cms4.17.0any
craftcmscraft_cms5.0.0any
craftcmscraft_cms5.0.0any
craftcmscraft_cms5.9.0any

References 2

  • github.com https://github.com/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8
    Patch
  • github.com https://github.com/craftcms/cms/security/advisories/GHSA-234q-vvw3-mrfq
    PatchVendor Advisory

Remediation

  • github.com https://github.com/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8
    Patch
  • github.com https://github.com/craftcms/cms/security/advisories/GHSA-234q-vvw3-mrfq
    PatchVendor Advisory