{"uuid": "9ef6d62f-6035-4f44-b950-9abf514d0232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-P8X7-9VFW-P7VC", "type": "seen", "source": "https://gist.github.com/alon710/839078dc1e6146ea4d82f12eb4312cc5", "content": "# GHSA-P8X7-9VFW-P7VC: GHSA-P8X7-9VFW-P7VC: Arbitrary User Password Reset via Mass Assignment in Craft CMS\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-P8X7-9VFW-P7VC\n\n## Summary\nA high-severity authorization bypass vulnerability in Craft CMS allows authenticated users to reset arbitrary user passwords, including administrator accounts, by exploiting a mass assignment vulnerability in the User element model.\n\n## TL;DR\nA mass assignment flaw in Craft CMS's User model allows authenticated users to modify sensitive internal properties, including password and lockout fields, bypassing security controls to achieve full administrator takeover.\n\n## Technical Details\n\n- **CWE ID**: CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.8\n- **Exploit Status**: none\n- **KEV Status**: not listed\n\n## Affected Systems\n\n- Craft CMS\n\n## Mitigation\n\n- Upgrade Craft CMS to version 5.10.8 or later.\n- Disable public profile updating controllers if not strictly required.\n- Audit custom elements for mass assignment vulnerabilities.\n\n**Remediation Steps:**\n1. Verify the current Craft CMS version.\n2. Update the composer.json file to require craftcms/cms: >=5.10.8.\n3. Run 'composer update craftcms/cms' to pull the patched version.\n4. Deploy the updated composer.lock file and verify successful deployment in production.\n\n## References\n\n- [GHSA-P8X7-9VFW-P7VC Advisory](https://github.com/advisories/GHSA-P8X7-9VFW-P7VC)\n- [Fix Commit](https://github.com/craftcms/cms/commit/cbdf45fbd3ab548b147d7de375f6f6f580b7c294)\n- [Craft CMS v5.10.8 Release](https://github.com/craftcms/cms/releases/tag/5.10.8)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-P8X7-9VFW-P7VC) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T09:39:30.015152Z"}