CVE-2026-14793: Craft CMS Authorization Bypass in Global Sets Reordering

Technical summary

The vulnerability exists in the actionReorderSets method within src/controllers/GlobalsController.php. The endpoint fails to properly validate user permissions before allowing reordering operations on global sets. This authorization flaw (CWE-285, CWE-639) allows authenticated users to bypass access controls and modify global sets they would otherwise be restricted from changing. The vulnerability is network-accessible and requires only valid authentication credentials to exploit.

Business impact

Organizations running Craft CMS may face data integrity risks if unauthorized users modify critical global site settings. Global sets often control content, configuration, and site-wide variables; unauthorized changes could deface content, alter user-facing site behavior, or disrupt site functionality. The impact is typically limited to integrity (not confidentiality or availability), making this a moderate business concern requiring timely remediation but not an emergency.

Affected systems

Craft CMS versions 4.18.0.1 and earlier are vulnerable. The issue is resolved in version 4.18.1 and later. Organizations should verify their current Craft CMS version immediately. This affects any Craft CMS installation where the GlobalsController component is active, which is standard in typical deployments.

Exploitability

Exploitation requires valid authentication credentials—an attacker cannot exploit this remotely without a user account. However, the low complexity of the attack (once authenticated) and the lack of any user interaction requirement make this straightforward for insiders or those who have obtained user credentials through other means. The CVSS 3.1 score of 4.3 reflects the authentication requirement that limits attack surface to logged-in users.

Remediation

Upgrade Craft CMS to version 4.18.1 or later immediately. The patch commit 9bd05c91e6a7e6da5e949ec41a31c220c059aa04 implements proper authorization checks in the actionReorderSets method. After upgrading, verify that global set permissions are properly enforced by testing with restricted user accounts.

Patch guidance

Apply the official Craft CMS update to version 4.18.1 via your normal package management process. Verify the patch commit hash 9bd05c91e6a7e6da5e949ec41a31c220c059aa04 in your upgrade to confirm authenticity. Test the upgrade in a staging environment first to ensure no custom code or plugins are incompatible. Plan the upgrade during a maintenance window if your site receives continuous traffic.

Detection guidance

Monitor application logs for unusual requests to the /globals/reorder-sets endpoint or actionReorderSets method, particularly from user accounts with lower privilege levels. Look for modifications to global sets by users who do not normally have permission to edit them. Check your Craft CMS version number regularly (Configuration → System Info) and set alerts for version drift. Review user activity logs for unauthorized changes to global settings.

Why prioritize this

While the CVSS score is moderate (4.3), the vulnerability should be prioritized because it directly impacts data integrity through authorization bypass, affects authenticated users who may have legitimate access to other site areas, and patches are readily available. Organizations should plan remediation within 2-4 weeks depending on deployment complexity and risk tolerance.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM severity) reflects: network accessibility (AV:N) allowing remote exploitation; low attack complexity (AC:L) making exploitation straightforward once authenticated; requirement for valid login credentials (PR:L) that limits attack surface; no impact on confidentiality (C:N); limited integrity impact (I:L) affecting only specific settings; and no availability impact (A:N). The score appropriately flags this as a business-logic authorization issue rather than a critical vulnerability, but one requiring timely attention.

Frequently asked questions