CVE-2026-14793: CVE-2026-14793: Authorization Bypass in Craft CMS GlobalsController actionReorderSets

#security #cve #cybersecurity

CVE-2026-14793: Authorization Bypass in Craft CMS GlobalsController actionReorderSets

Vulnerability ID: CVE-2026-14793
CVSS Score: 5.3
Published: 2026-08-06

An authorization bypass vulnerability in Craft CMS allows authenticated control panel users with low privileges to reorder global sets. This alters structure and writes to the project configuration database schema without administrative rights.

TL;DR

Missing admin authorization check in Craft CMS's GlobalsController allows low-privilege authenticated users to reorder global sets via direct API endpoint calls.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-285
Attack Vector: Network
CVSS v4.0: 5.3 (Medium)
EPSS Score: 0.00224 (Percentile: 13.08%)
Impact: Partial Integrity Modification
Exploit Status: Proof of Concept
KEV Status: Not Listed

Affected Systems

Craft CMS
Craft CMS: <= 4.18.0.1 (Fixed in: 4.18.1)
Craft CMS: 5.x < 5.10.3 (Fixed in: 5.10.3)

Code Analysis

Commit: 9bd05c9

Add $this->requireAdmin() authorization gate to GlobalsController's actionReorderSets endpoint

Mitigation Strategies

Upgrade Craft CMS core dependency to the patched release versions.
Restrict Control Panel interface exposure to specific IP address blocks.
Enforce Least Privilege user provisioning across content-authoring roles.
Implement WAF detection signatures to identify unauthorized routing attempts.

Remediation Steps:

Execute 'composer update craftcms/cms' inside the project root path.
Deploy code changes through the normal continuous integration and staging environment pipelines.
Audit existing active Control Panel accounts to confirm user roles match access requirements.
Monitor application logs for recurrent 403 response patterns against administrative endpoints.

References

Read the full report for CVE-2026-14793 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community