Is there a patch available for CVE-2026-14794?

Yes, a patch is available for CVE-2026-14794. Update the affected software to the latest version immediately.

Craft CMS CVE-2026-14794

Q: What is the CVSS score of CVE-2026-14794?

CVE-2026-14794 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41805 MEDIUM

Improper Authorization (CWE-285)

2026-07-06 VulDB

GHSA-rmj4-m9cp-mp9v

PHP Authentication Bypass Cms

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requiring low-privilege auth; only confidentiality impact via user stats disclosure; no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 04:52 vuln.today

DescriptionCVE.org

A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.

AnalysisAI

Improper authorization in Craft CMS up to 4.18.0.1 allows authenticated low-privileged users to access new user statistics for arbitrary user groups via the Charts endpoint. The flaw resides in the actionGetNewUsersData function within src/controllers/ChartsController.php, where the userGroupId parameter is not properly validated against the requesting user's authorization scope, enabling horizontal privilege escalation to read data across user group boundaries. No public exploit has been identified at time of analysis, but a vendor-released patch is available in version 4.18.1.

Technical ContextAI

Craft CMS is a PHP-based content management system. The vulnerability is rooted in CWE-285 (Improper Authorization), a failure to correctly enforce access control decisions after authentication. The affected component is the Charts controller at src/controllers/ChartsController.php, specifically the actionGetNewUsersData action which serves aggregated user registration data to the CMS dashboard. The vulnerable CPE is cpe:2.3:a:craft:cms:*:*:*:*:*:*:*:* covering versions up to and including 4.18.0.1. Rather than verifying that the requesting user holds authorization over the queried userGroupId, the endpoint appears to trust the caller-supplied parameter directly, constituting a broken object-level authorization (BOLA/IDOR) pattern at the API layer.

RemediationAI

Upgrade Craft CMS to version 4.18.1 or later, which contains the fix introduced in commit 9ee53efc1314e6aba32771c66a13e072a246f4ce. The release is available at https://github.com/craftcms/cms/releases/tag/4.18.1. For installations where immediate upgrade is not possible, restrict access to the Charts endpoint at the web server or application firewall layer by limiting requests to the /charts/ controller route to only users with explicitly elevated roles; this reduces the exposure window but does not constitute a full fix and may break legitimate dashboard functionality for lower-privileged editors. Audit existing low-privileged user accounts for signs of unauthorized access to user group analytics as a precautionary measure.