CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.11 are vulnerable due to inadequate validation of the admin flag during user registration, which allows attackers to register using an email address from a deactivated admin account. This flaw can lead to unauthorized users gaining administrator privileges, particularly when public registration is enabled and email verification is disabled. Organizations using Craft CMS should prioritize patching this vulnerability to prevent potential exploitation and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.