CVE-2026-14794: Craft CMS Authorization Bypass in Charts Endpoint

Technical summary

CVE-2026-14794 is an improper authorization flaw in Craft CMS affecting the Charts controller (src/controllers/ChartsController.php). The actionGetNewUsersData endpoint fails to properly validate the userGroupId argument, enabling authenticated attackers to bypass authorization checks and read restricted chart data across user groups they do not own. The vulnerability chain involves CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization). Mitigation is available via upgrade to version 4.18.1, identified by patch commit 9ee53efc1314e6aba32771c66a13e072a246f4ce.

Business impact

This vulnerability exposes sensitive user metrics and analytics data to unauthorized internal users. In multi-tenant or role-based Craft CMS deployments, a standard user account can exfiltrate insights about user group sizes, activity patterns, and administrative metrics intended for higher-privilege roles. While direct data modification or system compromise is not possible, the confidentiality breach may violate data governance policies, inform social engineering, or assist internal threat actors in reconnaissance. Organizations using Craft CMS for content management in regulated industries (healthcare, finance) should treat this as a priority due to the potential for compliance violations.

Affected systems

Craft CMS versions 4.18.0.1 and earlier are vulnerable. The flaw exists in the Charts Endpoint controller and is reachable by any authenticated user of the CMS. Unpatched Craft CMS installations in production environments, especially those with multi-user or role-segregated content workflows, are directly at risk.

Exploitability

Exploitation requires a valid Craft CMS login; no public exploit code or detailed proof-of-concept is known to be circulating. The CVSS 3.1 score of 4.3 (MEDIUM) reflects the network accessibility combined with the low privilege barrier. An attacker with basic user credentials can immediately exploit this by crafting requests to the Charts Endpoint with modified userGroupId values. The vulnerability is not complex to exploit once an attacker has authenticated access.

Remediation

Upgrade Craft CMS to version 4.18.1 or later immediately. The patch addresses the authorization validation logic in the actionGetNewUsersData function. Organizations should coordinate the upgrade during a maintenance window, as it may require testing with any custom dashboard or charting integrations. Verify the applied patch commit hash against the vendor advisory to confirm successful application.

Patch guidance

Apply Craft CMS 4.18.1 as soon as feasible. This is a routine security update with no known breaking changes for standard installations. If your deployment relies on custom modifications to the Charts controller, review those customizations before upgrading to ensure compatibility. Test in a staging environment first, particularly if you have extended the chart functionality or use third-party charting plugins. Monitor Craft CMS security advisories for any subsequent patch releases.

Detection guidance

Monitor application logs for repeated requests to the Charts Endpoint (typically /admin/charts/action-get-new-users-data) with varying or unauthorized userGroupId parameters. Look for 200 OK responses to requests that span multiple user groups, especially from non-administrative user accounts. If you cannot upgrade immediately, consider implementing a Web Application Firewall (WAF) rule to restrict access to the Charts Endpoint to known administrative IP ranges or require additional authentication factors.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt patching in organizations with strict data access controls or regulatory requirements. The authorization bypass affects all authenticated users and could enable privilege escalation through information disclosure. The fix is straightforward and low-risk, making it an easy win for security operations. Prioritize based on your environment's sensitivity: high for healthcare, finance, and government; moderate for general business use.

Risk score, explained

CVSS 3.1 score of 4.3 reflects network-accessible attack surface (AV:N) with low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and limited scope (S:U). The impact is confined to confidentiality (C:L) with no integrity or availability degradation (I:N, A:N). The score is elevated above 'low' because authorization bypass in multi-user systems can facilitate lateral reconnaissance and social engineering, even if direct harm is deferred.

Frequently asked questions