CVE-2026-14794mediumCWE-266CWE-285

CVE-2026-14794: falha de média gravidade em Craft CMS

Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

Publicada em

Seguir esta CVE+ Monitorar CMS+ Monitorar craftcms/cms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Produtos afetados
Craft · CMS
CVEs relacionadas — Craft CMS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-35939MEDIUMCraft CMS stores user-provided content in session filesEPSS 1.4%KEVCVE-2026-14793MEDIUMCraft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorizationEPSS 0.4%