A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute

Published September 10, 2026 CVE-2026-79987

Craft CMS can let a logged-in, non-admin control-panel user run operating-system commands with the website's PHP privileges. That can expose secrets and content, change files, or disrupt the site.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 5.10.13
Affected versions
5.8.0 to before 5.10.13
Weakness
CWE-470Unsafe Reflection
Exploit likelihood
0.36% in 30 daysEPSS, higher than 29% of known flaws
Affects
CMS
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75586ENISA vulnerability database

How it works

  • A remote user needs a valid control-panel account with accessCp permission.
  • Crafted search data reaches code that treats user-controlled input as an instruction.
  • Craft then runs that instruction with the PHP worker's privileges.
  • The supplied evidence does not establish additional access requirements.

What to do

Compare your installed Craft CMS version with the affected range of 5.8.0 through 5.10.12. Review which control-panel accounts have accessCp permission.

Update Craft CMS to version 5.10.13 or later.

Technical details

Affected software: CMSPHP package by craftcms

CVE-2026-79987 affects Craft CMS versions 5.8.0 or newer and before 5.10.13. A remote authenticated non-admin user with accessCp can execute operating-system commands using the Craft PHP worker's privileges, potentially reaching application secrets, credentials, content, and writable files.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source