Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.

Craft CMS versions prior to 5.10.11 contain a critical authorization flaw in the actionGetPasswordResetUrl endpoint that fails to verify whether the requesting user holds administrator status. Users with the administrateUsers permission can exploit this to generate valid password reset URLs for any administrator account. The companion actionSetPassword endpoint compounds the issue by validating only the verification code without checking the caller's session context. Combined, these flaws allow a lower-privileged user to fully take over administrator accounts and gain complete control-panel access. The vulnerability requires no special tooling beyond standard HTTP requests. Affected deployments should upgrade to Craft CMS 5.10.11 or later immediately. Public advisories are available from both the Craft CMS GitHub security advisory and VulnCheck.