CVE-2026-33159: Craft CMS Auth Bypass Vulnerability

CVE-2026-33159 Overview

CVE-2026-33159 is an authentication bypass vulnerability in Craft CMS, a popular content management system. The vulnerability allows unauthenticated guest users to access the Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions including regenerate-yaml and apply-yaml-changes without proper authentication. This missing authentication for critical function (CWE-306) impacts Craft CMS versions from 4.0.0-RC1 to before 4.17.8 and from 5.0.0-RC1 to before 5.9.14.

Critical Impact

Unauthenticated attackers can manipulate Craft CMS configuration by executing Config Sync actions, potentially leading to site misconfiguration, data integrity issues, or enabling further attack vectors through malicious YAML configuration changes.

Affected Products

• Craft CMS versions 4.0.0-RC1 through 4.17.7
• Craft CMS versions 5.0.0-RC1 through 5.9.13
• All release candidate and stable releases within the affected version ranges

Discovery Timeline

• 2026-03-24 - CVE-2026-33159 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33159

Vulnerability Analysis

This vulnerability stems from missing authentication checks on the Config Sync updater functionality within Craft CMS. The Config Sync feature is designed to allow administrators to manage and synchronize configuration across environments using YAML files. However, the affected versions fail to properly verify that the user making requests to the Config Sync endpoints is authenticated before processing those requests.

An attacker exploiting this vulnerability can access the Config Sync updater index without credentials, retrieve signed configuration data, and trigger state-changing actions. The regenerate-yaml action could be used to overwrite existing configuration files, while apply-yaml-changes could apply malicious or unintended configuration modifications to the CMS.

Root Cause

The root cause is a missing authentication for critical function (CWE-306) in the Config Sync controller endpoints. The application fails to implement proper access control checks before allowing users to interact with the configuration synchronization functionality. Guest users who should not have any administrative privileges can access and invoke these sensitive operations.

Attack Vector

The vulnerability is exploitable over the network without authentication. An attacker can target vulnerable Craft CMS installations by:

1. Accessing the Config Sync updater index endpoint directly via HTTP requests
2. Obtaining signed configuration data from the exposed endpoint
3. Executing regenerate-yaml to modify the site's YAML configuration files
4. Using apply-yaml-changes to apply malicious configuration changes to the active site

The attack requires no user interaction and can be performed remotely against any publicly accessible Craft CMS installation running vulnerable versions. The vulnerability enables unauthorized access to configuration management functions that should be restricted to authenticated administrators only.

Detection Methods for CVE-2026-33159

Indicators of Compromise

• Unexpected HTTP requests to Config Sync related endpoints from unauthenticated sources
• Unauthorized modifications to config/project/project.yaml or related configuration files
• Anomalous changes to site configuration without corresponding admin activity logs
• New or modified YAML configuration files with timestamps outside normal maintenance windows

Detection Strategies

• Monitor web server access logs for requests targeting /admin/config-sync or similar Config Sync endpoints from unauthorized IP addresses
• Implement file integrity monitoring on Craft CMS configuration directories to detect unauthorized YAML file changes
• Configure web application firewalls (WAF) to alert on suspicious patterns of unauthenticated requests to administrative endpoints
• Review Craft CMS application logs for Config Sync actions performed without corresponding authenticated sessions

Monitoring Recommendations

• Enable comprehensive logging for all Config Sync related activities in Craft CMS
• Deploy network-based intrusion detection systems (IDS) with rules to identify exploitation attempts targeting this vulnerability
• Implement real-time alerting for any configuration file modifications in the Craft CMS project configuration directory
• Conduct regular security audits of Craft CMS access logs to identify potential unauthorized access attempts

How to Mitigate CVE-2026-33159

Immediate Actions Required

• Upgrade Craft CMS version 4.x installations to version 4.17.8 or later immediately
• Upgrade Craft CMS version 5.x installations to version 5.9.14 or later immediately
• Restrict network access to administrative endpoints using firewall rules or reverse proxy configurations until patching is complete
• Review recent configuration changes and YAML files for any unauthorized modifications

Patch Information

Craft CMS has released patched versions that address this vulnerability. The fix is available in version 4.17.8 for the 4.x branch and version 5.9.14 for the 5.x branch. The patch implements proper authentication checks for Config Sync endpoints to ensure only authorized users can access these functions.

For detailed patch information, refer to the GitHub Commit Details and the GitHub Security Advisory GHSA-6mrr-q3pj-h53w. Patched releases are available at GitHub Release 4.17.8 and GitHub Release 5.9.14.

Workarounds

• Implement IP-based access restrictions to the Craft CMS administrative area at the web server or network level
• Use a Web Application Firewall (WAF) to block unauthenticated requests to Config Sync endpoints
• Disable the Config Sync feature if not actively in use until the patch can be applied
• Place the Craft CMS admin panel behind a VPN or other network-level authentication mechanism

# Example nginx configuration to restrict admin access by IP
location /admin {
    allow 192.168.1.0/24;  # Trusted admin network
    allow 10.0.0.0/8;       # Internal network
    deny all;               # Deny all other access
}