highAug 6, 2026

Craft CMS Improper Authorization: Arbitrary Password Reset via Element Save

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A flaw in Craft CMS lets any logged-in user silently reset their own password, and lets users with 'Edit users' permission reset any other user's password, including admins, without needing elevated…

Packagecraftcms/cms
Ecosystemcomposer
Affected>= 5.0.0-RC1, < 5.10.8
Fixed in5.10.8
Craft CMS Improper Authorization: Arbitrary Password Reset via Element Save

The problem

The elements/save action accepts a newPassword field for User elements. The UserPasswordValidator rule for newPassword carried no on scenario restriction, making the field freely mass-assignable through the generic element save flow.

The dedicated users/set-password action, which enforces elevated session checks and current-password verification, is bypassed entirely. Any authenticated control-panel user can reset their own password. A user with the Edit users permission can reset any other user's password, including administrator accounts, escalating to full account takeover.

Proof of concept

A working proof-of-concept for this issue in craftcms/cms, with the exact payload below.

http
POST /index.php?p=actions/elements/save HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
Cookie: CraftSessionId=<valid_session>

CSRF=<csrf_token>&elementType=craft%5Celements%5CUser&elementId=<target_user_id>&newPassword=Attacker123%21

In Yii2, a model validator without an explicit on scenario applies to every scenario, including the default mass-assignment scenario used by elements/save. Because UserPasswordValidator had no scenario guard on the newPassword rule, posting newPassword to the element save endpoint was silently accepted and persisted.

The patch (commit cbdf45fbd3ab548b147d7de375f6f6f580b7c294) adds an on scenario restriction so the newPassword validator only fires during the dedicated password-change scenario, which requires an elevated session. This removes newPassword from the mass-assignable attribute surface in the generic save flow.

The root cause maps to CWE-285 (Improper Authorization) and is a textbook mass-assignment / missing access control check.

The fix

Upgrade Craft CMS to version 5.10.8 or later. No configuration workaround exists for earlier releases. After upgrading, review control-panel user permissions and audit recent password-change activity for signs of exploitation.

Reporter not attributed.

References: [1][2][3][4]

Related research