CVE-2026-14793: Craft CMS Auth Bypass Vulnerability

CVE-2026-14793 Overview

CVE-2026-14793 is an authorization bypass vulnerability in Craft CMS versions up to and including 4.18.0.1. The flaw resides in the actionReorderSets function within src/controllers/GlobalsController.php, which handles the reorder-sets endpoint. The function failed to verify administrative privileges before processing reorder requests, allowing authenticated non-admin users to reorder global sets. The vulnerability is exploitable remotely over the network and requires low-privileged authentication. Craft CMS addressed the issue in version 4.18.1 through commit 9bd05c91e6a7e6da5e949ec41a31c220c059aa04, which adds an admin permission check. The weakness is classified under [CWE-285: Improper Authorization].

Critical Impact
Authenticated low-privileged users can bypass authorization controls to reorder global sets, affecting content integrity in Craft CMS installations prior to 4.18.1.

Affected Products

Craft CMS versions up to and including 4.18.0.1
Component: src/controllers/GlobalsController.php (reorder-sets endpoint)
Fixed in Craft CMS 4.18.1

Discovery Timeline

2026-07-06 - CVE-2026-14793 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14793

Vulnerability Analysis

The vulnerability stems from a missing authorization check in the actionReorderSets controller action. The endpoint required only a POST request and JSON acceptance header before executing privileged operations. Any authenticated user could invoke the reorder-sets endpoint and manipulate the ordering of global sets. Global sets in Craft CMS store site-wide content and configuration data, making their ordering an administrative concern. The Craft::$app->getGlobals()->reorderSets($setIds) call executed without verifying the caller held admin privileges.

Root Cause

The root cause is improper authorization [CWE-285]. The actionReorderSets method invoked requirePostRequest() and requireAcceptsJson() but omitted a call to requireAdmin(). This design flaw treated the reorder operation as a general authenticated action rather than an administrative one. The fix introduces the missing requireAdmin() guard to enforce the intended privilege boundary.

Attack Vector

An attacker with any authenticated Craft CMS account can send a crafted POST request to the reorder-sets endpoint with a JSON body containing the ids parameter. The server processes the reordering without validating that the caller is an administrator. No user interaction is required beyond having valid low-privileged credentials.

php

     {
         $this->requirePostRequest();
         $this->requireAcceptsJson();
+        $this->requireAdmin();
 
         $setIds = Json::decode($this->request->getRequiredBodyParam('ids'));
         Craft::$app->getGlobals()->reorderSets($setIds);

Source: GitHub Commit 9bd05c91 — the patch adds requireAdmin() to enforce administrative authorization before the reorder operation proceeds.

Detection Methods for CVE-2026-14793

Indicators of Compromise

POST requests to the reorder-sets controller endpoint originating from non-admin user sessions
Unexpected changes in the ordering of Craft CMS global sets without corresponding admin activity in audit logs
HTTP requests with Content-Type: application/json targeting the globals controller reorder action from low-privileged accounts

Detection Strategies

Review Craft CMS request logs for calls to the actionReorderSets endpoint and correlate the invoking user against the admin user list
Compare current global set ordering against known-good baselines to identify unauthorized modifications
Monitor for anomalous authenticated activity from accounts that do not typically interact with global set management

Monitoring Recommendations

Enable verbose access logging on the Craft CMS web tier to capture user identifiers alongside controller action names
Alert when non-admin sessions issue POST requests to controllers historically restricted to administrators
Track the Craft CMS installed version across environments to identify hosts running 4.18.0.1 or earlier

How to Mitigate CVE-2026-14793

Immediate Actions Required

Upgrade Craft CMS to version 4.18.1 or later, which contains commit 9bd05c91e6a7e6da5e949ec41a31c220c059aa04
Audit existing global set configurations to confirm no unauthorized reordering has occurred
Review the user account roster and remove or downgrade accounts that no longer require access

Patch Information

The official patch is published in Craft CMS 4.18.1. See the GitHub Release 4.18.1 and the GitHub Commit Details. The fix adds an explicit requireAdmin() call to the actionReorderSets method in src/controllers/GlobalsController.php. Additional vulnerability metadata is available on VulDB CVE-2026-14793.

Workarounds

Restrict network access to the Craft CMS control panel to trusted administrator IP ranges via web application firewall rules
Temporarily disable non-admin authenticated accounts until the upgrade to 4.18.1 is complete
Add a reverse proxy rule that blocks POST requests to the reorder-sets endpoint from sessions lacking admin cookies or tokens

bash

# Example nginx rule to restrict the reorder-sets endpoint to trusted IPs
location ~ /actions/globals/reorder-sets {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://craftcms_backend;
}