CVE-2026-72786 is an authentication bypass in Craft CMS that allows any user with the 'edit users' permission to change passwords on any account, including admin-level accounts, through the elements/save API flow. The vulnerability is not a missing check in the traditional sense—it's an architectural failure where the system treats password changes as ordinary field updates rather than privileged operations.
The core problem: Craft CMS's element model abstracts users as just another content element. When 'edit users' permission was designed, it scoped access to the elements/save flow, which handles all element updates. Password fields became structurally indistinguishable from profile fields. The permission correctly gates who can access the save endpoint—but it was designed around content-editing semantics, not authentication security. 'Edit users' implicitly became 'edit authentication credentials,' and no verification layer existed between the two.
If you run Craft CMS, treat this as higher severity than the CVSS 6.5 suggests. The rating assumes proper permission scoping, but the vulnerability exploits exactly that permission model. A content editor, moderator, or plugin developer with 'edit users' access can escalate to full admin control. From there, the blast radius extends to database access, hosting control planes, and third-party API keys often stored in user fields. The CVSS measures the technical vulnerability; the post-exploitation terrain is far wider.
The fix likely requires treating password fields as operationally distinct from profile data—adding a verification gate between 'can edit user data' and 'can modify authentication credentials.' This may contradict Craft's unified element philosophy, which could mean the remediation is an architectural refactor rather than a simple patch. Regardless of how Craft addresses it, you should audit who currently holds 'edit users' permission in your installation, treat that permission as equivalent to admin access, and consider whether any plugin or custom code exposes the elements/save flow in ways that broaden the attack surface.