CVE-2026-109306

MEDIUMCVSS 5.9

Description

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Timeline

Published:October 12th, 2026 5:17 PM

Last modified:October 18th, 2026 12:17 PM

CVSS Scoring

CVSS v3: 5.9 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://github.com/craftcms/cms/security/advisories/GHSA-4wfw-q5w3-jh42
https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-missing-authorization-via-app-switch-to-licensed-edition

Source: NIST NVD · Data may lag official sources by up to one minute