An improper authorization flaw in Craft CMS allows authenticated users to reset passwords, potentially leading to unauthorized account takeover and total system compromise.

The vulnerability resides in the elements/save action, where the UserPasswordValidator fails to restrict the newPassword field to authorized scenarios. This allows any authenticated user to change their own password, and users with the Edit users permission to change passwords for any user, including administrators.

This vulnerability poses a significant risk to organizational security by enabling unauthorized account takeover. An attacker who gains access to a low-privileged account can escalate their privileges to administrator status, leading to full control over the CMS, data exfiltration, or site defacement. With a CVSS score of 8.7, this high-severity flaw represents a critical threat to the confidentiality, integrity, and availability of the managed content and underlying infrastructure.

Immediate Action: Update Craft CMS to version 5.10.8 or later immediately to apply the patch that enforces proper session verification and authorization checks.

Proactive Monitoring: Review administrative access logs for suspicious password change events or unusual user account modifications occurring outside of standard maintenance windows.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to inspect requests to the elements/save endpoint, although a direct software update remains the only definitive remediation.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

The ability for an authenticated user to reset passwords without current credentials is a severe oversight that directly facilitates account takeover attacks. Given the potential for full administrative compromise, organizations using affected versions of Craft CMS must prioritize patching to version 5.10.8. Failure to apply this update leaves the application susceptible to privilege escalation and should be treated as an immediate operational priority.