CVE-2026-14793: Craft CMS Missing Authorization Check Allows Non-admin Vulnerability
MODERATECVE-2026-14793 is a MODERATE (CVSS 4.3) missing authorization check allows non-admin vulnerability (CWE-862: Missing Authorization) affecting Craft CMS libraries in the Packagist ecosystem. The issue involves missing authorization check allows non-admin control panel users to reorder global sets. Remediation is available by upgrading affected packages to version 4.18.1, 5.10.3.
CVE-2026-14793 at a Glance
Security Impact
CVSS: 4.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
How to Fix CVE-2026-14793
To remediate this vulnerability, upgrade all affected Craft CMS dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade craftcms/cms to 4.18.1Upgrade craftcms/cms to 5.10.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for craftcms/cmsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-14793, inspect your project dependencies for Craft CMS:
inspect dependencies for craftcms/cmsAnalyze the terminal output to locate any version of Craft CMS in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.18.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-862: Missing Authorization, where the product does not perform an authorization check when an actor attempts to access a resource or perform an action. In Craft CMS, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-14793 Affected Craft CMS Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
craftcms/cms
|
Packagist |
≥ 4.0.0-RC1
< 4.18.1
|
4.18.1
|
|
craftcms/cms
|
Packagist |
≥ 5.0.0-RC1
< 5.10.3
|
5.10.3
|
References
Frequently Asked Questions
What is CVE-2026-14793?
Which Craft CMS versions are affected?
What version fixes CVE-2026-14793?
Is craftcms/cms affected?
What is the CVSS score of CVE-2026-14793?
What CWE is associated with CVE-2026-14793?
How can I check Packagist dependencies for CVE-2026-14793?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9p7c-v5x3-rfx8",
"modified" : "2026-08-06T20:55:48Z",
"published" : "2026-08-06T20:55:48Z",
"aliases" : [ "CVE-2026-14793" ],
"summary" : "Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets",
"details" : "The `reorder-sets` action in Craft CMS’s `GlobalsController` is missing the `requireAdmin()` check that the adjacent `save-set` and `delete-set` actions both enforce. Any authenticated control panel user can POST to `/actions/globals/reorder-sets` and permanently reorder all global sets in the project config, regardless of whether they have admin access. The reordering is written through to the project config and persists across requests.\n\n## Description\n\n`GlobalsController` exposes three administrative actions for managing global set structure. Two of them gate on admin status; the third does not.\n\n## Prerequisites\n\n- A Craft CMS instance with at least two global sets and a non-admin control panel user account.\n\n## Impact\n\nA non-admin control panel user can reorder all global sets. While this does not expose or modify content, reordering global sets modifies the project config -- a versioned artifact that is typically committed to source control and deployed across environments. An attacker can create noise in the project config history, trigger config-sync conflicts, or manipulate the display order seen by all editors in the admin panel. The same non-admin user cannot create or delete global sets because those actions correctly enforce `requireAdmin()`.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "craftcms/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0-RC1"
}, {
"fixed" : "4.18.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "craftcms/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0-RC1"
}, {
"fixed" : "5.10.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/security/advisories/GHSA-9p7c-v5x3-rfx8"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-14793"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/commit/9bd05c91e6a7e6da5e949ec41a31c220c059aa04"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/craftcms/cms"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/releases/tag/4.18.1"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/releases/tag/5.10.3"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/cve/CVE-2026-14793"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/submit/850792"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/vuln/376387"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-862" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-08-06T20:55:48Z",
"nvd_published_at" : null
}
}