Craft CMS versions before 5.10.11 contain a flaw where the system fails to validate the admin flag during user registration. This missing verification allows the admin flag from a deactivated account to persist into new accounts. As a result, an attacker who registers with an email address that belonged to a former administrator can inherit full administrative privileges. The vulnerability is classified as CWE‑269 (Improper Privilege Management) and grants the attacker complete control over site content, configuration, and data, leading to a severe loss of confidentiality, integrity, and availability for the affected site.

The vulnerability affects Craft CMS 5.10.x releases prior to 5.10.11 on any web server or hosting environment running those versions. All installations with public registration enabled and email verification disabled are potentially susceptible, and users who rely on Craft CMS’s default configuration—particularly those who allow anyone to register—are at higher risk.

The CVSS score of 9.2 classifies this issue as Critical, and although the EPSS score is not available, the lack of rate limiting or automated detection increases the likelihood of exploitation in environments with open registration. Based on the description, it is inferred that an attacker would register a new account using a deactivated admin’s email address when public registration is enabled and email verification is disabled; this simple action would immediately grant the account administrative privileges. The vulnerability is not currently listed in the CISA KEV catalog, but the straightforward registration route and absence of input validation make the attack vector highly feasible.