EUVD-2026-41804
GHSA-9p7c-v5x3-rfx8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring authenticated low-privilege access; impact is integrity-only with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. Upgrading to version 4.18.1 is able to address this issue. The patch is identified as 9bd05c91e6a7e6da5e949ec41a31c220c059aa04. The affected component should be upgraded.
AnalysisAI
Authorization bypass in Craft CMS up to 4.18.0.1 allows authenticated low-privilege users to invoke the reorder-sets endpoint and manipulate Global Set ordering outside their authorized scope. The flaw resides in the actionReorderSets function of GlobalsController.php and is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class root cause where resource-level permission checks are absent. No public exploit has been identified at time of analysis and no CISA KEV listing exists; a vendor-released patch is available in version 4.18.1.
Technical ContextAI
Craft CMS (CPE: cpe:2.3:a:craft:cms:*:*:*:*:*:*:*:*) is a PHP-based content management platform. The affected component is the actionReorderSets method in src/controllers/GlobalsController.php, which handles ordering of Global Sets - site-wide content structures used across templates. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the endpoint likely accepts user-supplied set identifiers in the request payload and processes the reorder operation without verifying whether the authenticated user holds sufficient permissions over each referenced set. This is a resource-level access control gap distinct from route-level authentication - the user is legitimately authenticated but is not entitled to act on the specific resources referenced. This pattern is common in CMS platforms where permission models enforce broad capability flags (e.g., 'can edit globals') but fail to scope them to specific owned resources.
RemediationAI
Upgrade Craft CMS to version 4.18.1, which resolves the authorization bypass via patch commit 9bd05c91e6a7e6da5e949ec41a31c220c059aa04 (https://github.com/craftcms/cms/commit/9bd05c91e6a7e6da5e949ec41a31c220c059aa04); the patched release is available at https://github.com/craftcms/cms/releases/tag/4.18.1. As a compensating control prior to patching, administrators should audit CMS user permissions and restrict the Global Sets management capability to trusted administrator accounts only, removing it from contributor or editor roles - though this may limit legitimate editorial workflows. A WAF rule blocking POST requests to the reorder-sets endpoint path for non-admin sessions could further reduce exposure, but may interfere with CMS functionality and is not a substitute for patching.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today