CVE-2026-109306: Craft CMS Auth Bypass Vulnerability

CVE-2026-109306 Overview

CVE-2026-109306 is a missing authorization vulnerability [CWE-862] in Craft CMS versions 5.0.0 through 5.10.13. The flaw resides in the AppController::actionSwitchToLicensedEdition() action, which fails to verify administrative privileges before changing the installed edition. Any authenticated user, including low-privileged front-end accounts, can invoke the route when the licensed edition mismatches. The action persists the change in project config, and administrators cannot reverse the downgrade from the control panel. The issue affects integrity and availability of the Craft CMS installation.

Critical Impact

Authenticated low-privileged users can persistently downgrade a Craft CMS site edition through an unauthenticated action route, with no in-console recovery path for administrators.

Affected Products

• Craft CMS 5.0.0 through 5.10.13
• Craft CMS AppController::actionSwitchToLicensedEdition() endpoint
• Craft CMS project config persistence layer

Discovery Timeline

• 2026-10-12 - CVE-2026-109306 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109306

Vulnerability Analysis

The vulnerability stems from an authorization gap in the actionSwitchToLicensedEdition() controller action within Craft CMS's AppController. The action is intended to reconcile the running edition with the licensed edition, but it does not restrict callers to administrators. Any authenticated session, including the lowest-privileged front-end user accounts, satisfies the authentication check. When invoked while the installed edition does not match the licensed edition, the action writes the edition change to project config.

The write is persistent because project config is the source of truth for Craft's installed state. Administrators cannot roll back the switch from the control panel, forcing manual intervention at the configuration or database layer. This elevates a routine controller action into a durable business logic flaw that affects site capabilities tied to the Pro or Solo edition.

Root Cause

The root cause is a missing authorization check [CWE-862] inside AppController::actionSwitchToLicensedEdition(). The method relies solely on authentication context without validating that the caller holds the administrative permission required to modify installation-level configuration. Craft's permission model expects edition changes to be gated to admins, but the gate is absent on this route.

Attack Vector

Exploitation requires network access to the Craft CMS control panel URL and a valid authenticated session for any user role. An attacker submits a request to the switch-to-licensed-edition action route. If the installed edition differs from the licensed edition, the controller executes the change and persists it. No user interaction from an administrator is required, and no additional privileges beyond basic authentication are necessary.

The vulnerability is a business logic authorization flaw rather than an input validation issue, so there is no payload to craft beyond a well-formed request to the vulnerable route. See the GitHub Security Advisory GHSA-4wfw-q5w3-jh42 and the Vulncheck Advisory for Craft CMS for additional technical context.

Detection Methods for CVE-2026-109306

Indicators of Compromise

• Web server access logs showing requests to the app/switch-to-licensed-edition action route from non-administrative user sessions.
• Unexpected edition change entries recorded in Craft's project config history or project.yaml file.
• Administrators reporting that Craft CMS features tied to a specific edition have disappeared without authorized changes.

Detection Strategies

• Audit web access logs for POST requests to Craft AppController actions, correlating session identifiers to user roles.
• Compare the current edition value in project config against the licensed edition recorded in Craft Console.
• Review project config revision history for edition modifications that do not correspond to administrator activity windows.

Monitoring Recommendations

• Alert on changes to Craft project config files on disk, particularly keys controlling the installed edition.
• Monitor authentication logs for low-privileged accounts generating requests to control-panel action routes.
• Track Craft CMS version and patch status across hosted instances to flag deployments still on 5.0.0 through 5.10.13.

How to Mitigate CVE-2026-109306

Immediate Actions Required

• Upgrade Craft CMS to version 5.10.14 or later, which adds the missing authorization check on the affected action.
• Review project config history and restore the correct edition value if a downgrade has already occurred.
• Audit all front-end and low-privileged user accounts, disabling any that are no longer required.

Patch Information

Craft CMS 5.10.14 contains the fix for AppController::actionSwitchToLicensedEdition(). Refer to the GitHub Security Advisory GHSA-4wfw-q5w3-jh42 for upgrade guidance and the full list of affected commits.

Workarounds

• Restrict network access to the Craft CMS control panel action routes using web server or WAF rules until the patch is applied.
• Temporarily disable front-end user registration to limit the pool of authenticated accounts that can reach the vulnerable route.
• Enforce project config as read-only in deployment environments where edition changes are not expected, reverting unauthorized writes on next deploy.

# Configuration example
# Example nginx rule to block the vulnerable action route pending patch
location ~* ^/(index\.php/)?actions/app/switch-to-licensed-edition {
    deny all;
    return 403;
}