Missing Authorization Vulnerability in Craft CMS by Pixel & Tonic
CVE-2026-109306

6MEDIUM

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109306?

Craft CMS versions prior to 5.10.14 include a vulnerability in the AppController::actionSwitchToLicensedEdition() method. This flaw allows any authenticated user, even those with low privileges, to exploit the action route and change the licensed edition of the CMS. Consequently, they may persistently downgrade the site edition within the project configuration, leading to potential disruption in site management that administrators cannot reverse from the control panel.

Affected Version(s)

cms 5.0.0 < 5.10.14

cms 5.10.14

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/craft-cms-5.0.0-befo...
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.