CVE-2026-14794mediumCWE-266CWE-285

CVE-2026-14794: medium-severity vulnerability in Craft CMS

Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

Published

Follow this CVE+ Monitor CMS+ Monitor craftcms/cms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Affected products
Craft · CMS
Related CVEs — Craft CMS

In the same product, most dangerous first.

CVE-2025-35939MEDIUMCraft CMS stores user-provided content in session filesEPSS 1.3%KEVCVE-2026-14793MEDIUMCraft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorizationEPSS 0.4%