Log in Start free

Vulnerability · Published Jul 6, 2026 · Assigned by VulDB

CVE-2026-14793Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in CMS from Craft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 67.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. Upgrading to version 4.18.1 is able to address this issue. The patch is identified as 9bd05c91e6a7e6da5e949ec41a31c220c059aa04. The affected component should be upgraded.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistcraftcms/cms4.18.1GHSA-9p7c-v5x3-rfx8
Packagistcraftcms/cms5.10.3GHSA-9p7c-v5x3-rfx8

Affected products (as reported)

VendorProductVersions
Craft CMS 4.18.0.04.18.0.1

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References