GHSA-RVMM-V933-JGXQ: GHSA-rvmm-v933-jgxq: Missing Authorization Check in Craft CMS ChartsController

#security #cve #cybersecurity #ghsa

GHSA-rvmm-v933-jgxq: Missing Authorization Check in Craft CMS ChartsController

Vulnerability ID: GHSA-RVMM-V933-JGXQ
CVSS Score: 5.3
Published: 2026-08-06

An authorization bypass vulnerability in Craft CMS allows unauthenticated or low-privileged users to query and obtain sensitive time-series user registration counts and demographic metrics. This is due to a missing authorization check inside the actionGetNewUsersData endpoint of the ChartsController class.

TL;DR

Missing authorization in Craft CMS ChartsController allowed unauthorized access to sensitive time-series user metrics and registration demographics via /actions/charts/get-new-users-data prior to versions 4.18.1 and 5.10.3.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-862
Attack Vector: Network
CVSS: 5.3 (Medium)
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

Craft CMS
Craft CMS: >= 4.0.0-RC1, < 4.18.1 (Fixed in: 4.18.1)
Craft CMS: >= 5.0.0-RC1, < 5.10.3 (Fixed in: 5.10.3)

Code Analysis

Commit: 9ee53ef

Require CP request for actionGetNewUsersData

diff --git a/src/controllers/ChartsController.php b/src/controllers/ChartsController.php
index 0b4a9876097..ca5c6b1dd07 100644
--- a/src/controllers/ChartsController.php
+++ b/src/controllers/ChartsController.php
@@ -37,6 +37,8 @@ class ChartsController extends Controller
      */
     public function actionGetNewUsersData(): Response
     {
+        $this->requireCpRequest();
+
         $userGroupId = $this->request->getBodyParam('userGroupId');
         $startDateParam = $this->request->getRequiredBodyParam('startDate');
         $endDateParam = $this->request->getRequiredBodyParam('endDate');

Mitigation Strategies

Upgrade Craft CMS instances to patched versions 4.18.1 or 5.10.3 immediately.
Enforce context routing constraints on custom controllers.
Implement restrictive Web Application Firewall (WAF) policies for sensitive action endpoints.

Remediation Steps:

Navigate to the project root directory.
Execute composer update craftcms/cms to fetch the latest secure release.
Verify that requests to /actions/charts/get-new-users-data without a valid Control Panel session return a 400 Bad Request or redirect to login.
Audit logs for legacy unauthenticated POST requests targeting charts/get-new-users-data.

References

Read the full report for GHSA-RVMM-V933-JGXQ on our website for more details including interactive diagrams and full exploit analysis.

DEV Community