MEDIUMCVSS 4.2Vulnerability
CVE-2026-55186
### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
Properties
- Severity
- medium
- Summary
- MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
- Cvss score
- 4.2
- Retrieved at
- 2026-10-29T19:55:32+00:00
- Ghsa published
- 2026-10-29T16:32:39Z
- Source url
- https://github.com/advisories/GHSA-68wq-phq7-p2vg
- Ghsa updated
- 2026-10-29T16:32:40Z
- Ghsa id
- GHSA-68wq-phq7-p2vg
- Last source
- GitHub Advisory Database
- Cve id
- CVE-2026-55186
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-10-29T19:55:32+00:00
- Is ghsa only
- false
Related Entities (3)
AFFECTS (1)
HAS_WEAKNESS (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph