THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86731 (MEDIUM 6.5) — Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an adminis

[NVD] CVE-2026-86731 (MEDIUM 6.5) — Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an adminis

mednvdPublished 2026-09-08

CVE-2026-86731 CVSS: 6.5 MEDIUM Published: 2026-09-08T16:18:35.187

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an administrator, unlike the mirror action actionDeactivateUse

MITRE ATT&CK techniques

Control PanelT1218.002

Indicators of compromise

CVE-2026-86731cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86731