CraftCMS versions before 5.9.0‑beta.2 and 4.17.0‑beta.2 expose the actionSendActivationEmail() endpoint to unauthenticated users and miss a permission check for pending accounts. An attacker can send activation emails for any pending user by supplying the user ID, which may be guessed or enumerated. If the attacker also controls the target’s email address, they can activate the account and gain unauthorized access to the system. The weakness is classified as CWE‑639, indicating improper authorization handling.

All CraftCMS installations running versions earlier than 5.9.0‑beta.2 or 4.17.0‑beta.2 are affected, including 4.0.0, 4.0.0 RC1‑RC3, 4.17.0 beta1, 5.0.0 RC1, 5.9.0 beta1, and any prior releases. Users must verify their current version against these lists.

The vulnerability carries a CVSS score of 6.9 (moderate) and an EPSS score below 1 %, indicating very low to negligible current exploitation probability but still plausible. It is not listed in CISA’s KEV catalog. Attackers can exploit the unauthenticated endpoint to trigger mass activation emails or systematically enumerate user IDs, potentially leading to account takeover if email control is achieved. The lack of immediate exploitation evidence suggests the risk is primarily preventive, but the potential impact warrants rapid remediation.