CVE-2026-29069 json
Craft has an unauthenticated activation email trigger with potential user enumeration
published 2026-03-04 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-9452 , GHSA-234q-vvw3-mrfq
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.
Patch / fix
- packagist craftcms/cms 4.17.0-beta.2, 5.9.0-beta.2
- craftcms craft_cms 4.17.0-beta.2, 5.9.0-beta.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=5.0.0-RC1, <5.9.0-beta.2 >=4.0.0-RC1, <4.17.0-beta.2 |
5.9.0-beta.2 4.17.0-beta.2 |
Affected products
- craftcms cms
Classification
References
-
github.com
/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8
web, patch
-
github.com
/craftcms/cms/security/advisories/GHSA-234q-vvw3-mrfq
web, patch, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-29069
advisory
-
github.com
/craftcms/cms
package
Sources
- CVE List CVE-2026-29069
- GitHub Advisory GHSA-234q-vvw3-mrfq
- NVD CVE-2026-29069
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.