CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.8 are vulnerable to an authentication bypass that allows authenticated users with edit permissions to reset any user's password, including that of administrators, without proper verification. This could lead to unauthorized access and potential compromise of sensitive data. Organizations using affected versions should prioritize patching to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.