CVE-2026-109306

Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

State: Published
Severity: 6.0 Medium
Published: Oct 12, 2026
Updated: Oct 18, 2026
Reserved: Oct 12, 2026

Description

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
cmscraftcms	5.0.0 to before 5.10.14Affected 5.10.14Not affected

References

GitHub Security Advisory (GHSA-4wfw-q5w3-jh42)vendor-advisory
VulnCheck Advisory: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-editionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.