CVE-2026-29069: Craft CMS

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2.

Affected products

• Craft CMS Craft CMS: after 4.0.0, before 4.17.0 (fixed in 4.17.0); after 5.0.0, before 5.9.0 (fixed in 5.9.0); version 4.0.0 only; version 4.17.0 only; version 5.0.0 only; version 5.9.0 only

Published 2026-03-04. Last modified 2026-06-17.