A critical authorization bypass in Craft CMS allows authenticated users with administrative permissions to escalate privileges and gain full control over the application.

The application fails to perform adequate authorization checks within the actionGetPasswordResetUrl and actionSetPassword endpoints. An attacker with existing administrateUsers permissions can generate password reset tokens for administrator accounts, effectively bypassing session validation to hijack administrative sessions.

The ability to perform a complete control-panel takeover represents a significant risk to organizational integrity and data confidentiality. With a CVSS score of 8.8, this high-severity vulnerability allows an attacker to gain full administrative access, leading to potential data exfiltration, unauthorized configuration changes, and complete compromise of the underlying application infrastructure.

Immediate Action: Update Craft CMS to version 5.10.11 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review system access logs for unusual password reset activity or unauthorized administrative logins occurring outside of standard operational windows.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to monitor and block abnormal requests targeting the actionGetPasswordResetUrl and actionSetPassword endpoints.

Public Exploit Available: Unknown.

Given the potential for complete administrative takeover, this vulnerability poses a severe threat to any organization utilizing Craft CMS. Administrators must prioritize patching their environments to version 5.10.11 or higher. Until the update is applied, ensure that account permissions are strictly audited and limited to trusted personnel to reduce the surface area for potential exploitation.