Is CVE-2026-112775 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112775?

CVE-2026-112775 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-112775

Description

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.