CVE-2026-14794: Craft CMS Missing Authorization Check Allows Non-admin Vulnerability
MODERATECVE-2026-14794 is a MODERATE (CVSS 4.3) missing authorization check allows non-admin vulnerability (CWE-266: Incorrect Privilege Assignment) affecting Craft CMS libraries in the Packagist ecosystem. The issue involves missing authorization check allows non-admin control panel users access to user registration metrics. Remediation is available by upgrading affected packages to version 4.18.1, 5.10.3.
CVE-2026-14794 at a Glance
Security Impact
CVSS: 4.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
How to Fix CVE-2026-14794
To remediate this vulnerability, upgrade all affected Craft CMS dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade craftcms/cms to 4.18.1Upgrade craftcms/cms to 5.10.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for craftcms/cmsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-14794, inspect your project dependencies for Craft CMS:
inspect dependencies for craftcms/cmsAnalyze the terminal output to locate any version of Craft CMS in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.18.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-266: Incorrect Privilege Assignment, where a product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. In Craft CMS, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-14794 Affected Craft CMS Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
craftcms/cms
|
Packagist |
≥ 4.0.0-RC1
< 4.18.1
|
4.18.1
|
|
craftcms/cms
|
Packagist |
≥ 5.0.0-RC1
< 5.10.3
|
5.10.3
|
References
Frequently Asked Questions
What is CVE-2026-14794?
Which Craft CMS versions are affected?
What version fixes CVE-2026-14794?
Is craftcms/cms affected?
What is the CVSS score of CVE-2026-14794?
What CWE is associated with CVE-2026-14794?
How can I check Packagist dependencies for CVE-2026-14794?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-rvmm-v933-jgxq",
"modified" : "2026-08-31T19:43:20Z",
"published" : "2026-08-06T21:42:58Z",
"aliases" : [ "CVE-2026-14794" ],
"summary" : "Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics",
"details" : "`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('viewUsers')` authorization check. Any authenticated control panel user, regardless of permissions beyond `accessCp`, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.\n\nThe `viewUsers` permission is consistently required throughout the control panel before exposing user-related data, but this action enforces only the base `accessCp` check inherited from the framework.\n\nEach call returns the total count of users who joined the specified group in the requested period.\n\n## Impact\n\nAny control panel user with only `accessCp` permission can obtain the total number of registered users and their registration date distribution across any time window.\n\nIn installations with multiple editor roles, this allows a low-privilege control panel user to infer user group sizes and registration trends that would normally require the `viewUsers` permission to access.\n\nNo user PII (name, email, password) is disclosed; only aggregate counts and timestamps are returned. Confidentiality impact is low. No integrity or availability impact.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "craftcms/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0-RC1"
}, {
"fixed" : "4.18.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "craftcms/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0-RC1"
}, {
"fixed" : "5.10.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/security/advisories/GHSA-rvmm-v933-jgxq"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-14794"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4ce"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/craftcms/cms"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/releases/tag/4.18.1"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/releases/tag/5.10.3"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/cve/CVE-2026-14794"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/submit/850793"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/vuln/376388"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-266", "CWE-862" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-08-06T21:42:58Z",
"nvd_published_at" : null
}
}