Privilege Escalation Vulnerability Discovered in Craft CMS (CVE-2026-124429)

A privilege escalation vulnerability (CVE-2026-124429) has been identified in Craft CMS versions 5.0.0 through 5.11.1. This flaw allows unauthenticated public registrants to reclaim deactivated non-admin accounts and retain their direct permissions, potentially leading to privileged account takeover if email verification is disabled.