All vulnerabilities
CVE-2026-109306GHSA-4wfw-q5w3-jh42

Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

craftcms cms
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.10.14Fixed versionCVE List
Published12 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Text from CVE List

Affected versions 2

  • cmsaffected: 5.0.0 before 5.10.14CVE List
  • cmsunaffected: 5.10.14CVE List

References 2