Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109306Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Medium 5.9

In plain English

A medium-severity missing authorization in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 85.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	5.0.0 – before 5.10.14

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

References

GitHub Security Advisory (GHSA-4wfw-q5w3-jh42) vendor-advisory
VulnCheck Advisory: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition third-party-advisory