Listen to this Post
How CVE-2026-14794 Works
The vulnerability resides in `ChartsController::actionGetNewUsersData()` at /actions/charts/get-new-users-data, where a missing `requirePermission(‘viewUsers’)` authorization check allows any authenticated control panel user — regardless of permissions beyond `accessCp` — to POST to this endpoint and retrieve time‑series user registration counts for the entire site or for an arbitrary user group ID.
In Craft CMS, the `viewUsers` permission is consistently enforced throughout the control panel before exposing any user‑related data. However, this particular action only enforces the base `accessCp` check inherited from the framework, leaving the endpoint unprotected against privilege escalation.
An attacker with only the lowest‑level control panel access (e.g., an editor or contributor role) can craft a POST request to the vulnerable endpoint, supplying parameters such as userGroupId, startDate, and endDate. The endpoint then returns the total count of users who joined the specified group within the requested period, broken down by registration date.
No user PII (name, email, password) is disclosed — only aggregate counts and timestamps are returned. Consequently, the confidentiality impact is low, and there is no integrity or availability impact. The attack can be carried out remotely over the network and requires no interaction beyond valid low‑privilege credentials.
The vulnerability affects Craft CMS versions 4.0.0‑RC1 through 4.18.0.1, and 5.0.0‑RC1 through 5.10.2. The fix is included in versions 4.18.1 and 5.10.3, with the patch commit identified as 9ee53efc1314e6aba32771c66a13e072a246f4ce.
DailyCVE Form:
Platform: Craft CMS
Version: 4.0.0‑RC1 – 4.18.0.1 / 5.0.0‑RC1 – 5.10.2
Vulnerability: Missing Authorization (CWE‑862)
Severity: Medium (CVSS 5.3)
date: 2026‑07‑06
Prediction: 2026‑07‑25 (patch already released)
What Undercode Say: Analytics
- Affected component: `src/controllers/ChartsController.php` — Charts Endpoint
- Endpoint: `/actions/charts/get-new-users-data` (POST)
- Missing check: `requirePermission(‘viewUsers’)`
– Inherited check: `accessCp` (base framework check) - Exploitable parameter: `userGroupId`
– Patch commit: `9ee53efc1314e6aba32771c66a13e072a246f4ce`
– Fixed versions: 4.18.1 and 5.10.3
Bash / Code snippets:
Check your Craft CMS version php craft version
Example vulnerable POST request (authenticated session required) curl -X POST https://your-craft-site.com/actions/charts/get-new-users-data \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "userGroupId=1&startDate=2026-01-01&endDate=2026-08-07"
// Vulnerable code (simplified)
public function actionGetNewUsersData(): Response
{
// Only checks accessCp, missing requirePermission('viewUsers')
$this->requireCpRequest(); // Added in patch
// ... returns user registration counts
}
Upgrade to patched version composer require craftcms/cms:4.18.1
Exploit
A low‑privilege authenticated control panel user (e.g., with only `accessCp` permission) can POST to `/actions/charts/get-new-users-data` with a crafted `userGroupId` to retrieve registration counts for any user group. By iterating over group IDs and date ranges, the attacker can map user group sizes and registration trends — information normally restricted to users with the `viewUsers` permission.
The attack requires network access to the control panel and valid credentials, but is trivial to execute once an account exists. No user interaction is needed beyond the authenticated session.
Protection
- Upgrade Craft CMS to 4.18.1 or later (4.x branch) or 5.10.3 or later (5.x branch)
- Restrict control‑panel access by IP or VPN until patched
- Review and prune unnecessary low‑privilege user accounts
- Audit user group configurations and enforce least‑privilege assignments post‑upgrade
- Monitor logs for unexpected POST requests to `/actions/charts/get-new-users-data`
Impact
- Confidentiality: Low — only aggregate registration counts and timestamps are exposed; no PII disclosed
- Integrity: None
- Availability: None
- Business impact: In multi‑tenant or multi‑editor installations, a low‑privilege user can infer user group sizes and registration trends that would normally require the `viewUsers` permission to access
- Exploitation status: No known active exploitation; not listed in KEV
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
