Access Restriction Bypass Affecting craftcms/cms Open this link in a new tab package, versions >=0.0.0

  • Exploit Maturity

    Proof of concept

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    10 May 2022

  • disclosed

    10 May 2022

  • credit

    Sandro Einfeldt

How to fix?

There is no fixed version for craftcms/cms.


craftcms/cms is a content management system.

Affected versions of this package are vulnerable to Access Restriction Bypass which allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Note: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).