Vulnerability Description
Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Craftcms | Craft Cms | < 4.17.0 |
Related Weaknesses (CWE)
References
- https://github.com/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8Patch
- https://github.com/craftcms/cms/security/advisories/GHSA-234q-vvw3-mrfqPatchVendor Advisory
FAQ
What is CVE-2026-29069?
CVE-2026-29069 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission c...
How severe is CVE-2026-29069?
CVE-2026-29069 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-29069?
Check the references section above for vendor advisories and patch information. Affected products include: Craftcms Craft Cms.