Craft CMS 5.9.0 Beta 1
Approved changes feed: RSS · Atom
cpe:2.3:a:craftcms:craft_cms:5.9.0:beta1:*:*:*:*:*:*
part: a version: 5.9.0 update: beta1
| Vendor | Craftcms (251e238f-ce53-56ed-bc94-804b74356686) |
|---|---|
| Product | Craft Cms (a92c5963-2d04-59bc-90a5-a8f29f883095) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/craftcms/cms |
purl2cpe | 2026-06-01 10:17:10.565523 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-29069 |
vulnerable | 2026-06-08 07:55:16.072292 |
Craft has an unauthenticated activation email trigger with potential user enumeration
Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.
Published: 2026-03-04T16:57:44.477Z
Updated: 2026-03-04T17:31:39.392Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.