CVE-2026-29069
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Mar 4, 2026
CISA due date
—
The record
Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | craftcms/cms | 4.0.0-RC1 | 4.17.0-beta.2 |
| Packagist | craftcms/cms | 5.0.0-RC1 | 5.9.0-beta.2 |
Related vulnerabilities
- GHSA-234q-vvw3-mrfq Craft CMS has unauthenticated activation email trigger with potential user enumeration Same vulnerability
- CVE-2026-28696 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28781 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28784 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28782 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28783 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28697 Craft is a content management system (CMS). Also affects craftcms/cms
- CVE-2026-28695 Craft is a content management system (CMS). Also affects craftcms/cms