Is CVE-2026-84795 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84795?

CVE-2026-84795 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-84795

Description

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.