Search for packages
| purl | pkg:composer/craftcms/cms@5.6.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2re8-4twc-eqez
Aliases: CVE-2025-68454 GHSA-742x-x762-7383 |
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI For this to work, users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. References: https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 |
Affected by 40 other vulnerabilities. |
|
VCID-33wy-gw8z-gud7
Aliases: CVE-2025-46731 GHSA-7c58-g782-9j38 |
Affected by 47 other vulnerabilities. |
|
|
VCID-3u81-kkt8-j7e7
Aliases: CVE-2026-33158 GHSA-3pvf-vxrv-hh9c |
Affected by 3 other vulnerabilities. |
|
|
VCID-4zfr-4pgf-zke4
Aliases: CVE-2026-28697 GHSA-v47q-jxvr-p68x |
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates An authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the `craft.app.fs.write()` method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. --- |
Affected by 20 other vulnerabilities. |
|
VCID-51qg-ehr3-3qeu
Aliases: CVE-2026-25494 GHSA-m5r2-8p9x-hp5m |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation The `saveAsset` GraphQL mutation uses `filter_var(..., FILTER_VALIDATE_IP)` to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. --- |
Affected by 33 other vulnerabilities. |
|
VCID-5h4n-14xc-uuf6
Aliases: CVE-2025-68436 GHSA-53vf-c43h-j2x9 |
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Resources: https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 |
Affected by 40 other vulnerabilities. |
|
VCID-68jz-k8d5-u7dk
Aliases: CVE-2026-29113 GHSA-vg3j-hpm9-8v5v |
Craft CMS has a potential information disclosure vulnerability in preview tokens Craft CMS has a CSRF issue in the preview token endpoint at `/actions/preview/create-token`. The endpoint accepts an attacker-supplied `previewToken`. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. --- |
Affected by 17 other vulnerabilities. |
|
VCID-6epu-syvm-d3ed
Aliases: CVE-2025-68455 GHSA-255j-qw47-wjh5 |
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior This was reported as a vulnerability in Yii framework on August 7th (https://github.com/yiisoft/yii2/security/advisories/GHSA-gcmh-9pjj-7fp4). The Yii framework team denies responsibility for this (placing the onus on application developers) and hence has not (and seemingly will not) provide a fix at the framework level. Hence, I am reporting this to Craft as I found it to affect the latest (`5.6.0`) version of Craft CMS. Leveraging a legitimate but maliciously crafted Yii `Behavior` class, it’s possible to trigger Remote Code Execution (RCE) via Reflection when the tainted `Behavior` is attached to a Yii `Component`, and an event is also fired on the tainted `Component`. |
Affected by 40 other vulnerabilities. |
|
VCID-76vz-cxx8-z7fc
Aliases: GHSA-g3hp-vvqf-8vw6 |
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page A stored XSS vulnerability exists in the User Permissions page. The User Group name is rendered without proper HTML escaping in the permissions section, allowing an attacker to execute arbitrary JavaScript when another user views or edits a user's permissions. > [!NOTE] > This is a separate vulnerability from the previously reported "[Stored XSS via User Group Name in User Settings Page](https://github.com/craftcms/cms/security/advisories/GHSA-2423-8xxj-wc3g)" and "[Multiple Stored XSS in User Group Edit Page](https://github.com/craftcms/cms/security/advisories/GHSA-vx7g-xw92-g4xj)". This affects a different sink: the individual user's permissions page. |
Affected by 33 other vulnerabilities. |
|
VCID-785m-94zq-mqe8
Aliases: CVE-2026-41128 GHSA-jq2f-59pj-p3m3 |
Affected by 0 other vulnerabilities. |
|
|
VCID-7b71-dsva-cfan
Aliases: CVE-2026-25496 GHSA-9f5h-mmq6-2x78 |
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the `|md|raw` Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. |
Affected by 33 other vulnerabilities. |
|
VCID-ccwe-z8nr-3qhq
Aliases: CVE-2026-25497 GHSA-fxp3-g6gw-4r4v |
Craft CMS: GraphQL Asset Mutation Privilege Escalation Type: Privilege Escalation (CWE-269) Affected: Craft CMS 5.x (likely affects 4.x and 3.x as well) Location: `src/gql/resolvers/mutations/Asset.php lines 57-107` |
Affected by 20 other vulnerabilities. |
|
VCID-ch5h-xzgt-6kgs
Aliases: CVE-2026-28782 GHSA-jxm3-pmm2-9gf6 |
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action The "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission (where the "Duplicate" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating **other users' entries** by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. |
Affected by 20 other vulnerabilities. |
|
VCID-efkn-13cf-97c3
Aliases: CVE-2026-27129 GHSA-v2gc-rm6g-wrw9 |
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution The SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)). |
Affected by 28 other vulnerabilities. |
|
VCID-ejv9-c3hf-jfax
Aliases: CVE-2026-28783 GHSA-5fvc-7894-ghp4 |
Craft CMS has Twig Function Blocklist Bypass Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have `allowAdminChanges` enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. Twig has already deprecated this behavior, and it will eventually be removed from Twig altogether. https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096 This has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the `enableTwigSandbox` config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it. Existing projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting. |
Affected by 20 other vulnerabilities. |
|
VCID-g17s-3ghd-5fhm
Aliases: GHSA-6j87-m5qx-9fqp |
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. |
Affected by 28 other vulnerabilities. |
|
VCID-gxan-r3pw-7uhw
Aliases: CVE-2026-33157 GHSA-2fph-6v5w-89hh |
Affected by 9 other vulnerabilities. |
|
|
VCID-j9n2-1u2k-ckc5
Aliases: CVE-2026-28784 GHSA-qc86-q28f-ggww |
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI For this to work, the attacker must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Alternatively, they can have a non-administrator account with `allowAdminChanges` disabled, but they must have access to the System Messages utility. It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue. References: https://github.com/craftcms/cms/pull/18208 |
Affected by 20 other vulnerabilities. |
|
VCID-jxub-yja7-2qhf
Aliases: CVE-2025-57811 GHSA-crcq-738g-pqvc |
Affected by 45 other vulnerabilities. |
|
|
VCID-jy6d-5zfh-7ycp
Aliases: CVE-2026-25498 GHSA-7jx7-3846-m7w7 |
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior A Remote Code Execution (RCE) vulnerability exists in Craft CMS where the `assembleLayoutFromPost()` function in `src/services/Fields.php` fails to sanitize user-supplied configuration data before passing it to `Craft::createObject()`. This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an **unpatched variant** of the behavior injection vulnerability addressed in GHSA-255j-qw47-wjh5, affecting different endpoints through a separate code path. --- |
Affected by 33 other vulnerabilities. |
|
VCID-kf34-utdc-cbay
Aliases: CVE-2026-33162 GHSA-f582-6gf6-gx4g |
Affected by 3 other vulnerabilities. |
|
|
VCID-m28c-yq43-a7cq
Aliases: GHSA-4mgv-366x-qxvx |
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options Stored XSS in multiple settings. Names/labels are rendered without sanitization via `checkbox.twig` template which uses `{{ label|raw }}`. --- |
Affected by 20 other vulnerabilities. |
|
VCID-mfvj-g7bk-h3hw
Aliases: CVE-2026-33159 GHSA-6mrr-q3pj-h53w |
Affected by 3 other vulnerabilities. |
|
|
VCID-ntx4-ssgk-jqgh
Aliases: CVE-2026-27126 GHSA-3jh3-prx3-w6wc |
Craft CMS has Stored XSS in Table Field via "HTML" Column Type A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. |
Affected by 28 other vulnerabilities. |
|
VCID-nyqy-y3dw-eyer
Aliases: CVE-2025-35939 GHSA-7vrx-9684-xrf2 |
Affected by 46 other vulnerabilities. |
|
|
VCID-pggs-g9c8-w7d1
Aliases: CVE-2025-68456 GHSA-v64r-7wg9-23pr |
Unauthenticated Craft CMS users can trigger a database backup Unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure.Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.Resources: https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md |
Affected by 40 other vulnerabilities. |
|
VCID-q1jg-5qq3-zkbv
Aliases: CVE-2026-33160 GHSA-5pgf-h923-m958 |
Affected by 3 other vulnerabilities. |
|
|
VCID-rhm7-ju23-yuby
Aliases: CVE-2026-31858 GHSA-g7j6-fmwx-7vp8 |
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection The `ElementSearchController::actionSearch()` endpoint is missing the `unset()` protection that was added to ElementIndexesController in [GHSA-2453-mppf-46cj](https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj). The exact same SQL injection vulnerability (including `criteria[orderBy]`, the original advisory vector) works on this controller because the fix was never applied to it. Any authenticated control panel user (no admin required) can inject arbitrary SQL via `criteria[where]`, `criteria[orderBy]`, or other query properties, and extract the full database contents via boolean-based blind injection. Users should update to the patched 5.9.9 release to mitigate the issue. |
Affected by 15 other vulnerabilities. |
|
VCID-rnze-pnhe-abh4
Aliases: CVE-2026-33161 GHSA-vgjg-248p-rfm2 |
Affected by 3 other vulnerabilities. |
|
|
VCID-rrce-ncgp-qbcg
Aliases: CVE-2026-32267 GHSA-cc7p-2j3x-x7xf |
Affected by 10 other vulnerabilities. |
|
|
VCID-s9mh-xu8b-fqgf
Aliases: CVE-2026-27127 GHSA-gp2f-7wcm-5fhx |
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints. |
Affected by 28 other vulnerabilities. |
|
VCID-t4zv-mpqc-9fbx
Aliases: CVE-2026-32263 GHSA-qx2q-q59v-wf3j |
Affected by 11 other vulnerabilities. |
|
|
VCID-t5h6-xvev-f3g7
Aliases: CVE-2025-68437 GHSA-x27p-wfqw-hfcc |
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation The Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume. Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.References: https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md |
Affected by 40 other vulnerabilities. |
|
VCID-ttgr-49ur-z7aa
Aliases: CVE-2026-41130 GHSA-95wr-3f2v-v2wh |
Affected by 0 other vulnerabilities. |
|
|
VCID-u3cv-q3ft-qkhj
Aliases: CVE-2026-25493 GHSA-8jr8-7hr4-vhfx |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect The `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. --- |
Affected by 33 other vulnerabilities. |
|
VCID-ukq9-ggdc-byf5
Aliases: CVE-2026-27128 GHSA-6fx5-5cw5-4897 |
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit A Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The `getTokenRoute()` method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. |
Affected by 28 other vulnerabilities. |
|
VCID-uzyt-dujv-nqh6
Aliases: CVE-2026-25495 GHSA-2453-mppf-46cj |
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` The `element-indexes/get-elements` endpoint is vulnerable to **SQL Injection** via the `criteria[orderBy]` parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with **Control Panel access** can inject arbitrary SQL into the `ORDER BY` clause by omitting `viewState[order]` (or setting both to the same payload). > [!NOTE] > The `ORDER BY` clause executes per row. `SLEEP(1)` on 10 rows = 10s delay. --- |
Affected by 33 other vulnerabilities. |
|
VCID-vg28-8erb-27ae
Aliases: CVE-2026-28781 GHSA-2xfc-g69j-x2mp |
Craft CMS: Entries Authorship Spoofing via Mass Assignment The entry creation process allows for **Mass Assignment** of the `authorId` attribute. A user with "Create Entries" permission can inject the `authorIds[]` (or `authorId`) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others. Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship. |
Affected by 20 other vulnerabilities. |
|
VCID-vknb-zmk9-z3cc
Aliases: CVE-2026-31857 GHSA-fp5j-j7j4-mcxc |
CraftCMS has an RCE vulnerability via relational conditionals in the control panel A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The `BaseElementSelectConditionRule::getElementIds()` method passes user-controlled string input through `renderObjectTemplate()` -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.99 release to mitigate the issue. |
Affected by 15 other vulnerabilities. |
|
VCID-w35e-5gaq-y3aw
Aliases: CVE-2026-25491 GHSA-7pr4-wx9w-mqwr |
Craft CMS Vulnerable to Stored XSS in Entry Types Name Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. --- |
Affected by 33 other vulnerabilities. |
|
VCID-w9cn-xgye-jber
Aliases: CVE-2025-32432 GHSA-f3gw-9ww9-jmc3 |
Affected by 46 other vulnerabilities. |
|
|
VCID-whnf-tybt-qqbf
Aliases: GHSA-44px-qjjc-xrhq |
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata ### Summary An authenticated low-privileged user can call `assets/preview-file` for an asset they are not authorized to view and still receive preview response data (`previewHtml`) for that private asset. The returned preview HTML included a private preview image route containing the target private `assetId`, even though `canView` was `false` for the attacker account. ### Details 1. `assets/preview-file` accepts a maliciously controlled `assetId` and renders preview output. 2. The action does not enforce per-asset view authorization prior to returning preview content. 3. As a result, an authenticated user without asset-view permission can still obtain private preview output. This affects Craft installations with authenticated users of mixed privilege levels with private assets. ### Resources - d30df3112220db1ffd6726a3ed11857014c7fb27 - b1cddf72c98a |
Affected by 3 other vulnerabilities. |
|
VCID-xpq3-v9ts-x7es
Aliases: CVE-2026-41129 GHSA-3m9m-24vh-39wx |
Affected by 0 other vulnerabilities. |
|
|
VCID-xysn-pqxv-hyds
Aliases: CVE-2026-32262 GHSA-472v-j2g4-g9h2 |
Affected by 11 other vulnerabilities. |
|
|
VCID-zbrb-dmub-67as
Aliases: CVE-2025-54417 GHSA-2vcf-qxv3-2mgw |
Affected by 45 other vulnerabilities. |
|
|
VCID-zebb-ngev-a7de
Aliases: CVE-2026-32264 GHSA-4484-8v2f-5748 |
Affected by 11 other vulnerabilities. |
|
|
VCID-zh94-u2by-xkg5
Aliases: CVE-2026-28696 GHSA-7x43-mpfg-r9wj |
Craft CMS has IDOR via GraphQL @parseRefs The GraphQL directive `@parseRefs`, intended to parse internal reference tags (e.g., `{user:1:email}`), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in `Elements::parseRefs` fails to perform authorization checks, allowing attackers to read data they are not authorized to view. |
Affected by 20 other vulnerabilities. |
|
VCID-zybg-fqev-eber
Aliases: CVE-2026-29069 GHSA-234q-vvw3-mrfq |
Craft CMS has unauthenticated activation email trigger with potential user enumeration The `actionSendActivationEmail()` endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. The vulnerability is not that anonymous access exists - there’s a legitimate use case for it. The vulnerability is that the endpoint accepts arbitrary `userId` parameters without verifying ownership. Craft CMS allows public user registration. When a user registers but doesn’t receive their activation email (spam filter, typo correction, etc.), they need a way to request a resend. This is why `send-activation-email` is in the `allowAnonymous` array - it’s intentional self-service functionality. |
Affected by 19 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||