{"uuid": "166f9509-32b1-40ea-a373-f81db7bc9cd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-84795", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117201815744827307", "content": "https://nvd.nist.gov/vuln/detail/cve-2026-84795\nsev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCraft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.\nSeems like a pretty limited scope but it's still interesting to see that sev:CRIT in the CVE when the advisory says sev:MED:\nhttps://github.com/craftcms/cms/security/advisories/GHSA-242m-9wq7-vhwq", "creation_timestamp": "2026-09-02T14:03:05.026683Z"}