Craft CMS versions prior to 5.10.11 contain a critical authorization flaw in the actionGetPasswordResetUrl endpoint that fails to verify whether the requesting user holds administrator status. Non-admin users with the administrateUsers permission can exploit this to generate valid password reset URLs for any administrator account. The companion actionSetPassword endpoint only validates the verification code and does not check the caller's session, meaning an attacker can complete the password reset without any additional privileges. This chain of vulnerabilities enables a full control-panel takeover by any user with the administrateUsers permission. The issue is an improper access control vulnerability that bypasses authentication protections for privileged accounts. Organizations running Craft CMS should upgrade to version 5.10.11 or later immediately. No exploitation of specific threat actors has been reported in the article, but the impact is rated high due to the potential for complete administrative compromise.
