Craft CMS has unauthenticated activation email trigger with potential user enumeration
The advisory, in context
The actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system.
The vulnerability is not that anonymous access exists - there’s a legitimate use case for it. The vulnerability is that the endpoint accepts arbitrary userId parameters without verifying ownership.
Craft CMS allows public user registration. When a user registers but doesn’t receive their activation email (spam filter, typo correction, etc.), they need a way to request a resend. This is why send-activation-email is in the allowAnonymous array - it’s intentional self-service functionality.
The Security Gap
The endpoint accepts userId as the identifier:
$userId = $this->request->getRequiredBodyParam('userId');
This allows any visitor to trigger activation emails for any pending user, not just their own registration.
Background
When administrators create new user accounts in Craft CMS, users are created in a “pending” state until they activate their account via an emailed link. The actionSendActivationEmail() function sends (or resends) this activation email.
Expected Behavior: Anonymous users should only be able to resend activation emails for their own registration.
Actual Behavior:
- The endpoint is listed in
allowAnonymous- no login required (intentional for self-service) - For pending users, there is NO ownership verification
- Any unauthenticated visitor can trigger activation emails for ANY pending user by ID
Attack Scenarios
Scenario 1: Targeted Account Takeover
Prerequisites: Attacker controls target user’s email (compromised email, shared mailbox, typosquatting, etc.)
1. Admin creates a user account for victim@company.com
2. User account is in PENDING state (hasn’t activated yet)
3. Attacker has compromised victim@company.com (or it’s a typo of attacker’s domain)
4. Attacker discovers user ID (brute-force, GraphQL enumeration, or insider knowledge)
5. Attacker (unauthenticated) triggers: POST /actions/users/send-activation-email
6. Activation email sent to victim@company.com (attacker-controlled)
7. Attacker clicks activation link, sets password
8. Attacker gains access as that user with pre-assigned permissions
Scenario 2: User ID Brute-Force Enumeration
1. Attacker iterates through user IDs (1, 2, 3, ...)
2. For each ID, the attacker calls send-activation-email
3. Response reveals user state:
- "Activation email sent." = Pending user exists
- "User not found" = No user with this ID
- "Activation emails can only be sent to inactive or pending users" = Active user exists
4. Attacker builds a map of all user IDs and their states
5. For any pending user whose email an attacker controls → account takeover
Scenario 3: GraphQL + Targeted Attack
Prerequisites: GraphQL public schema allows user queries
1. Attacker queries GraphQL: { users { id email status } }
2. Filters for pending users
3. Cross-references with emails attacker controls
4. Triggers activation for the target user
5. Account takeover
Scenario 4: Email Spam / Harassment
1. Attacker brute-forces all pending user IDs
2. Repeatedly triggers activation emails
3. Victims receive unwanted emails from the Craft site
4. Potential for:
- Reputation damage to the site
- Email deliverability issues (spam reports)
- User confusion/phishing vector
References
https://github.com/craftcms/cms/commit/c3d02d4a7246f516933f42106c0a67ce062f68d8
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 5.0.0-RC1 before 5.9.0-beta.2
Fixed in 5.9.0-beta.2
146 explicitly affected versions
5.0.0, 5.0.0-RC1, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.1.0, 5.1.1, 5.1.10, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.2.0, 5.2.0-beta.1, 5.2.0-beta.2, 5.2.0-beta.3, 5.2.0-beta.4, 5.2.0-beta.5, 5.2.0-beta.6, 5.2.1, 5.2.10, 5.2.2, 5.2.3, 5.2.4, 5.2.4.1, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.3.0, 5.3.0-beta.1, 5.3.0-beta.2, 5.3.0.1, 5.3.0.2, 5.3.0.3, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.4.0.1, 5.4.1, 5.4.10, 5.4.10.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.5.1, 5.4.6, 5.4.7, 5.4.7.1, 5.4.8, 5.4.9, 5.5.0, 5.5.0.1, 5.5.1, 5.5.1.1, 5.5.10, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.6.1, 5.5.7, 5.5.8, 5.5.9, 5.6.0, 5.6.0.1, 5.6.0.2, 5.6.1, 5.6.10, 5.6.10.1, 5.6.10.2, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.5.1, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.9.1, 5.7.0, 5.7.0-beta.1, 5.7.0-beta.2, 5.7.1, 5.7.1.1, 5.7.10, 5.7.11, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.7.8, 5.7.8.1, 5.7.8.2, 5.7.9, 5.8.0, 5.8.1, 5.8.10, 5.8.11, 5.8.12, 5.8.13, 5.8.13.1, 5.8.13.2, 5.8.14, 5.8.15, 5.8.16, 5.8.17, 5.8.18, 5.8.19, 5.8.2, 5.8.20, 5.8.21, 5.8.22, 5.8.23, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.8.7, 5.8.8, 5.8.9, 5.9.0-beta.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.0.0-RC1"
},
{
"fixed": "5.9.0-beta.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.0",
"5.0.0-RC1",
"5.0.1",
"5.0.2",
"5.0.3",
"5.0.4",
"5.0.5",
"5.0.6",
"5.1.0",
"5.1.1",
"5.1.10",
"5.1.2",
"5.1.3",
"5.1.4",
"5.1.5",
"5.1.6",
"5.1.7",
"5.1.8",
"5.1.9",
"5.2.0",
"5.2.0-beta.1",
"5.2.0-beta.2",
"5.2.0-beta.3",
"5.2.0-beta.4",
"5.2.0-beta.5",
"5.2.0-beta.6",
"5.2.1",
"5.2.10",
"5.2.2",
"5.2.3",
"5.2.4",
"5.2.4.1",
"5.2.5",
"5.2.6",
"5.2.7",
"5.2.8",
"5.2.9",
"5.3.0",
"5.3.0-beta.1",
"5.3.0-beta.2",
"5.3.0.1",
"5.3.0.2",
"5.3.0.3",
"5.3.1",
"5.3.2",
"5.3.3",
"5.3.4",
"5.3.5",
"5.3.6",
"5.4.0",
"5.4.0.1",
"5.4.1",
"5.4.10",
"5.4.10.1",
"5.4.2",
"5.4.3",
"5.4.4",
"5.4.5",
"5.4.5.1",
"5.4.6",
"5.4.7",
"5.4.7.1",
"5.4.8",
"5.4.9",
"5.5.0",
"5.5.0.1",
"5.5.1",
"5.5.1.1",
"5.5.10",
"5.5.2",
"5.5.3",
"5.5.4",
"5.5.5",
"5.5.6",
"5.5.6.1",
"5.5.7",
"5.5.8",
"5.5.9",
"5.6.0",
"5.6.0.1",
"5.6.0.2",
"5.6.1",
"5.6.10",
"5.6.10.1",
"5.6.10.2",
"5.6.11",
"5.6.12",
"5.6.13",
"5.6.14",
"5.6.15",
"5.6.16",
"5.6.17",
"5.6.2",
"5.6.3",
"5.6.4",
"5.6.5",
"5.6.5.1",
"5.6.6",
"5.6.7",
"5.6.8",
"5.6.9",
"5.6.9.1",
"5.7.0",
"5.7.0-beta.1",
"5.7.0-beta.2",
"5.7.1",
"5.7.1.1",
"5.7.10",
"5.7.11",
"5.7.2",
"5.7.3",
"5.7.4",
"5.7.5",
"5.7.6",
"5.7.7",
"5.7.8",
"5.7.8.1",
"5.7.8.2",
"5.7.9",
"5.8.0",
"5.8.1",
"5.8.10",
"5.8.11",
"5.8.12",
"5.8.13",
"5.8.13.1",
"5.8.13.2",
"5.8.14",
"5.8.15",
"5.8.16",
"5.8.17",
"5.8.18",
"5.8.19",
"5.8.2",
"5.8.20",
"5.8.21",
"5.8.22",
"5.8.23",
"5.8.3",
"5.8.4",
"5.8.5",
"5.8.6",
"5.8.7",
"5.8.8",
"5.8.9",
"5.9.0-beta.1"
]
}From 4.0.0-RC1 before 4.17.0-beta.2
Fixed in 4.17.0-beta.2
230 explicitly affected versions
4.0.0, 4.0.0-RC1, 4.0.0-RC2, 4.0.0-RC3, 4.0.0.1, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.5.1, 4.0.5.2, 4.0.6, 4.1.0, 4.1.0.1, 4.1.0.2, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.4.1, 4.10.0, 4.10.0-beta.1, 4.10.0-beta.2, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.5, 4.10.6, 4.10.7, 4.10.8, 4.11.0, 4.11.0.1, 4.11.0.2, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.12.0, 4.12.1, 4.12.2, 4.12.3, 4.12.4, 4.12.4.1, 4.12.5, 4.12.6, 4.12.6.1, 4.12.7, 4.12.8, 4.12.9, 4.13.0, 4.13.1, 4.13.1.1, 4.13.10, 4.13.2, 4.13.3, 4.13.4, 4.13.5, 4.13.6, 4.13.7, 4.13.8, 4.13.9, 4.14.0, 4.14.0.1, 4.14.0.2, 4.14.1, 4.14.10, 4.14.11, 4.14.11.1, 4.14.12, 4.14.13, 4.14.14, 4.14.15, 4.14.2, 4.14.3, 4.14.4, 4.14.5, 4.14.6, 4.14.7, 4.14.8, 4.14.8.1, 4.14.9, 4.15.0, 4.15.0-beta.1, 4.15.0-beta.2, 4.15.0.1, 4.15.0.2, 4.15.1, 4.15.2, 4.15.3, 4.15.4, 4.15.5, 4.15.6, 4.15.6.1, 4.15.6.2, 4.15.7, 4.16.0, 4.16.1, 4.16.10, 4.16.11, 4.16.12, 4.16.13, 4.16.14, 4.16.15, 4.16.16, 4.16.17, 4.16.18, 4.16.19, 4.16.2, 4.16.3, 4.16.4, 4.16.5, 4.16.6, 4.16.6.1, 4.16.7, 4.16.8, 4.16.9, 4.16.9.1, 4.17.0-beta.1, 4.2.0, 4.2.0.1, 4.2.0.2, 4.2.1, 4.2.1.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.5.1, 4.2.5.2, 4.2.6, 4.2.7, 4.2.8, 4.3.0, 4.3.1, 4.3.10, 4.3.11, 4.3.2, 4.3.2.1, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.6.1, 4.3.7, 4.3.7.1, 4.3.8, 4.3.8.1, 4.3.8.2, 4.3.9, 4.4.0, 4.4.0-beta.1, 4.4.0-beta.2, 4.4.0-beta.3, 4.4.0-beta.4, 4.4.0-beta.5, 4.4.0-beta.6, 4.4.0-beta.7, 4.4.1, 4.4.10, 4.4.10.1, 4.4.11, 4.4.12, 4.4.13, 4.4.14, 4.4.15, 4.4.16, 4.4.16.1, 4.4.17, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.6.1, 4.4.7, 4.4.7.1, 4.4.8, 4.4.9, 4.5.0, 4.5.0-beta.1, 4.5.0-beta.2, 4.5.1, 4.5.10, 4.5.11, 4.5.11.1, 4.5.12, 4.5.13, 4.5.14, 4.5.15, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.5.6.1, 4.5.7, 4.5.8, 4.5.9, 4.6.0, 4.6.0-RC1, 4.6.1, 4.7.0, 4.7.1, 4.7.2, 4.7.2.1, 4.7.3, 4.7.4, 4.8.0, 4.8.1, 4.8.10, 4.8.11, 4.8.2, 4.8.3, 4.8.4, 4.8.5, 4.8.6, 4.8.7, 4.8.8, 4.8.9, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.9.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0-RC1"
},
{
"fixed": "4.17.0-beta.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.0",
"4.0.0-RC1",
"4.0.0-RC2",
"4.0.0-RC3",
"4.0.0.1",
"4.0.1",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.5.1",
"4.0.5.2",
"4.0.6",
"4.1.0",
"4.1.0.1",
"4.1.0.2",
"4.1.1",
"4.1.2",
"4.1.3",
"4.1.4",
"4.1.4.1",
"4.10.0",
"4.10.0-beta.1",
"4.10.0-beta.2",
"4.10.1",
"4.10.2",
"4.10.3",
"4.10.4",
"4.10.5",
"4.10.6",
"4.10.7",
"4.10.8",
"4.11.0",
"4.11.0.1",
"4.11.0.2",
"4.11.1",
"4.11.2",
"4.11.3",
"4.11.4",
"4.11.5",
"4.12.0",
"4.12.1",
"4.12.2",
"4.12.3",
"4.12.4",
"4.12.4.1",
"4.12.5",
"4.12.6",
"4.12.6.1",
"4.12.7",
"4.12.8",
"4.12.9",
"4.13.0",
"4.13.1",
"4.13.1.1",
"4.13.10",
"4.13.2",
"4.13.3",
"4.13.4",
"4.13.5",
"4.13.6",
"4.13.7",
"4.13.8",
"4.13.9",
"4.14.0",
"4.14.0.1",
"4.14.0.2",
"4.14.1",
"4.14.10",
"4.14.11",
"4.14.11.1",
"4.14.12",
"4.14.13",
"4.14.14",
"4.14.15",
"4.14.2",
"4.14.3",
"4.14.4",
"4.14.5",
"4.14.6",
"4.14.7",
"4.14.8",
"4.14.8.1",
"4.14.9",
"4.15.0",
"4.15.0-beta.1",
"4.15.0-beta.2",
"4.15.0.1",
"4.15.0.2",
"4.15.1",
"4.15.2",
"4.15.3",
"4.15.4",
"4.15.5",
"4.15.6",
"4.15.6.1",
"4.15.6.2",
"4.15.7",
"4.16.0",
"4.16.1",
"4.16.10",
"4.16.11",
"4.16.12",
"4.16.13",
"4.16.14",
"4.16.15",
"4.16.16",
"4.16.17",
"4.16.18",
"4.16.19",
"4.16.2",
"4.16.3",
"4.16.4",
"4.16.5",
"4.16.6",
"4.16.6.1",
"4.16.7",
"4.16.8",
"4.16.9",
"4.16.9.1",
"4.17.0-beta.1",
"4.2.0",
"4.2.0.1",
"4.2.0.2",
"4.2.1",
"4.2.1.1",
"4.2.2",
"4.2.3",
"4.2.4",
"4.2.5",
"4.2.5.1",
"4.2.5.2",
"4.2.6",
"4.2.7",
"4.2.8",
"4.3.0",
"4.3.1",
"4.3.10",
"4.3.11",
"4.3.2",
"4.3.2.1",
"4.3.3",
"4.3.4",
"4.3.5",
"4.3.6",
"4.3.6.1",
"4.3.7",
"4.3.7.1",
"4.3.8",
"4.3.8.1",
"4.3.8.2",
"4.3.9",
"4.4.0",
"4.4.0-beta.1",
"4.4.0-beta.2",
"4.4.0-beta.3",
"4.4.0-beta.4",
"4.4.0-beta.5",
"4.4.0-beta.6",
"4.4.0-beta.7",
"4.4.1",
"4.4.10",
"4.4.10.1",
"4.4.11",
"4.4.12",
"4.4.13",
"4.4.14",
"4.4.15",
"4.4.16",
"4.4.16.1",
"4.4.17",
"4.4.2",
"4.4.3",
"4.4.4",
"4.4.5",
"4.4.6",
"4.4.6.1",
"4.4.7",
"4.4.7.1",
"4.4.8",
"4.4.9",
"4.5.0",
"4.5.0-beta.1",
"4.5.0-beta.2",
"4.5.1",
"4.5.10",
"4.5.11",
"4.5.11.1",
"4.5.12",
"4.5.13",
"4.5.14",
"4.5.15",
"4.5.2",
"4.5.3",
"4.5.4",
"4.5.5",
"4.5.6",
"4.5.6.1",
"4.5.7",
"4.5.8",
"4.5.9",
"4.6.0",
"4.6.0-RC1",
"4.6.1",
"4.7.0",
"4.7.1",
"4.7.2",
"4.7.2.1",
"4.7.3",
"4.7.4",
"4.8.0",
"4.8.1",
"4.8.10",
"4.8.11",
"4.8.2",
"4.8.3",
"4.8.4",
"4.8.5",
"4.8.6",
"4.8.7",
"4.8.8",
"4.8.9",
"4.9.0",
"4.9.1",
"4.9.2",
"4.9.3",
"4.9.4",
"4.9.5",
"4.9.6",
"4.9.7"
]
}