CVE-2026-14794mediumCWE-266CWE-285

CVE-2026-14794: fallo de gravedad media en Craft CMS

Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

Publicada el

Seguir esta CVE+ Monitorear CMS+ Monitorear craftcms/cms

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Productos afectados
Craft · CMS
CVEs relacionadas — Craft CMS

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-35939MEDIUMCraft CMS stores user-provided content in session filesEPSS 1.4%KEVCVE-2026-14793MEDIUMCraft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorizationEPSS 0.4%