CVE-2026-14794: Craft CMS Auth Bypass Vulnerability

CVE-2026-14794 Overview

CVE-2026-14794 is an improper authorization vulnerability [CWE-266] in Craft CMS versions up to and including 4.18.0.1. The flaw resides in the actionGetNewUsersData function within src/controllers/ChartsController.php, part of the Charts Endpoint component. An authenticated remote attacker can manipulate the userGroupId parameter to bypass authorization checks and retrieve user chart data outside their intended scope. Craft CMS resolved the issue in version 4.18.1 via commit 9ee53efc1314e6aba32771c66a13e072a246f4ce, which enforces a control panel request check on the affected action.

Critical Impact
Authenticated attackers can bypass authorization checks on the Craft CMS charts endpoint to access user group data they are not entitled to view.

Affected Products

Craft CMS versions up to and including 4.18.0.1
Component: Charts Endpoint (src/controllers/ChartsController.php)
Fixed release: Craft CMS 4.18.1

Discovery Timeline

2026-07-06 - CVE-2026-14794 published to the National Vulnerability Database (NVD)
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14794

Vulnerability Analysis

The vulnerability exists in the actionGetNewUsersData method of the ChartsController class in Craft CMS. This controller action returns chart data about newly registered users filtered by the userGroupId request parameter. In vulnerable releases, the action does not enforce a control panel request check before processing the input. As a result, callers can influence the userGroupId argument used in the underlying query and cause the endpoint to return data that should be restricted to control panel users with the appropriate permissions.

The patch in commit 9ee53efc1314e6aba32771c66a13e072a246f4ce adds a $this->requireCpRequest() call at the top of the action. This forces the request to originate from an authenticated control panel context before the userGroupId, startDate, and endDate body parameters are read and processed.

Root Cause

The root cause is a missing authorization gate on a sensitive controller action, mapped to [CWE-266] Incorrect Privilege Assignment. The action accepted body parameters and executed the chart query without first validating that the request came from a permitted control panel context, leaving privilege enforcement dependent on downstream logic.

Attack Vector

Exploitation occurs over the network against the Craft CMS HTTP endpoint that dispatches to actionGetNewUsersData. An attacker with low privileges submits a crafted POST request containing a userGroupId value along with the required startDate and endDate parameters. Because the action bypasses the control panel request check, the response can expose new-user chart data for groups the caller should not access.

php

     */
    public function actionGetNewUsersData(): Response
    {
+       $this->requireCpRequest();
+
        $userGroupId = $this->request->getBodyParam('userGroupId');
        $startDateParam = $this->request->getRequiredBodyParam('startDate');
        $endDateParam = $this->request->getRequiredBodyParam('endDate');

Source: GitHub Commit 9ee53efc — the patch inserts requireCpRequest() so the action rejects non-control-panel requests before parameter processing.

Detection Methods for CVE-2026-14794

Indicators of Compromise

HTTP POST requests to the Craft CMS charts controller action actionGetNewUsersData originating from non-control-panel contexts.
Requests containing the body parameters userGroupId, startDate, and endDate sent by low-privileged accounts against affected Craft CMS builds prior to 4.18.1.
Repeated enumeration of userGroupId values from the same session or IP address within short time windows.

Detection Strategies

Inspect web server and application logs for calls to the charts endpoint (paths dispatching to ChartsController::actionGetNewUsersData) and correlate with the authenticated user's assigned permissions and group scope.
Alert on incrementing or fuzzed userGroupId values in POST bodies against unpatched Craft CMS instances.
Verify the running Craft CMS version via the admin dashboard or composer show craftcms/cms and flag any host below 4.18.1.

Monitoring Recommendations

Forward Craft CMS application logs and web server access logs to a centralized log platform and retain them for post-incident review.
Baseline normal usage of the charts endpoint (frequency, source IPs, user accounts) so deviations become visible.
Monitor for outbound data volumes from the CMS host that are inconsistent with expected dashboard usage.

How to Mitigate CVE-2026-14794

Immediate Actions Required

Upgrade Craft CMS to version 4.18.1 or later, which contains the fix committed as 9ee53efc1314e6aba32771c66a13e072a246f4ce.
Audit accounts with control panel access and revoke unused or over-privileged accounts to reduce the pool of potential abusers.
Review recent access logs for the charts endpoint to identify any unauthorized queries submitted before patching.

Patch Information

Craft CMS addressed CVE-2026-14794 in release 4.18.1. The fix adds $this->requireCpRequest() to actionGetNewUsersData so the action rejects requests that do not originate from an authenticated control panel session. Details are available in the Craft CMS 4.18.1 Release Notes and the security commit on GitHub. Additional references are tracked in the VulDB CVE-2026-14794 entry.

Workarounds

Restrict network access to the Craft CMS control panel and API endpoints to trusted IP ranges via reverse proxy or web application firewall rules until the upgrade is applied.
Enforce least-privilege on Craft CMS user groups so that only required accounts can authenticate to the control panel.
Add WAF signatures that block requests to the charts controller action carrying a userGroupId body parameter when the session does not correspond to a control panel user.

bash

# Upgrade Craft CMS to the patched release
composer require craftcms/cms:^4.18.1 -w
php craft up
php craft migrate/all --interactive=0

# Verify the installed version is 4.18.1 or higher
composer show craftcms/cms | grep versions