Listen to this Post
How CVE-2026-14793 Works
Craft CMS exposes a set of administrative endpoints through its `GlobalsController` for managing global sets — reusable content blocks that appear across the entire site. The controller provides three key actions: `save-set` (create/update a global set), `delete-set` (remove a global set), and `reorder-sets` (change the display order of all global sets). The first two actions correctly call `requireAdmin()` at the start of their execution, ensuring that only users with administrative privileges can perform those operations.
The `reorder-sets` action, however, was implemented without this critical authorization gate. Any authenticated control panel user — regardless of role or permission level — can send a POST request to `/actions/globals/reorder-sets` with a JSON payload specifying the new order of global sets. The controller processes the request and writes the reordered sequence directly into the project config, a YAML-based configuration file that tracks the entire site’s structure and is typically committed to version control.
Because the project config is a shared, versioned artifact, this reordering persists across all environments after deployment. The vulnerability does not expose sensitive data or allow content modification, but it enables a low-privilege user to permanently alter the administrative interface’s global set ordering for every editor. The same user cannot create or delete global sets, as those actions correctly enforce the `requireAdmin()` check.
The vulnerability affects Craft CMS versions up to 4.18.0.1 and all 5.x releases prior to 5.10.3. The fix was introduced in versions 4.18.1 and 5.10.3 via commit 9bd05c91e6a7e6da5e949ec41a31c220c059aa04, which adds the missing `$this->requireAdmin()` call to the `actionReorderSets` method. The vulnerability is assigned a CVSS v3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
DailyCVE Form:
Platform: Craft CMS
Version: <=4.18.0.1, <5.10.3
Vulnerability: Authorization Bypass
Severity: Medium (CVSS 4.3)
date: 2026-08-06
Prediction: Patch expected 2026-06-07
What Undercode Say:
Analytics & Detection
Monitor control panel access logs for unexpected POST requests to `/actions/globals/reorder-sets` from non-admin users. The following `grep` command can be used to audit Craft CMS logs for suspicious activity:
grep -E "POST /actions/globals/reorder-sets" storage/logs/web.log | grep -v "admin"
To check if your project config has been tampered with, compare the current `config/project.yaml` against the last known good version in source control:
git diff config/project.yaml | grep -A5 -B5 "globalSets"
For real-time monitoring, deploy a WAF rule that blocks non-admin sessions from accessing the `reorder-sets` endpoint. Example ModSecurity rule:
SecRule REQUEST_URI "/actions/globals/reorder-sets" \ "id:10001,phase:1,deny,status:403,msg:'CVE-2026-14793 blocked'"
Exploit:
A Proof-of-Concept exploit requires a valid Craft CMS session cookie from a non-admin control panel user. The attacker sends a POST request with a JSON body containing the reordered global set IDs:
curl -X POST https://target.com/actions/globals/reorder-sets \
-H "Content-Type: application/json" \
-H "Cookie: craftSessionId=..." \
-d '{"ids":["globalSet1","globalSet3","globalSet2"]}'
If successful, the server responds with a `204 No Content` status and the project config is permanently updated. The attacker can repeat this request arbitrarily to create noise in the config history or induce merge conflicts in collaborative development workflows.
Protection:
Upgrade Craft CMS to version 4.18.1 or 5.10.3 immediately. Run the following command in your project root:
composer update craftcms/cms
If an immediate upgrade is not feasible, apply the following hotfix by overriding the `GlobalsController` in a custom module:
public function beforeAction($action)
{
if ($action->id === 'reorder-sets') {
$this->requireAdmin();
}
return parent::beforeAction($action);
}
Additionally, restrict control panel access to trusted IP ranges and enforce least-privilege user provisioning.
Impact:
- Project Config Corruption: Non-admin users can permanently reorder global sets, altering the `project.yaml` file that is shared across all environments.
- Development Workflow Disruption: Unauthorized reordering creates noise in version control history and can trigger config-sync conflicts during deployment.
- Administrative Interface Manipulation: The display order of global sets in the control panel is changed for all editors, potentially causing confusion or hiding critical sets from view.
- No Data Exposure: The vulnerability does not expose or modify actual content, nor does it allow creation or deletion of global sets.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
