CVE-2026-109306
5.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-862
Impact
Authenticated low-privileged users can downgrade the Craft CMS edition in project config, causing denial of service and disabling features. Attackers need network access and any valid user account to trigger the action.
Root cause
AppController::actionSwitchToLicensedEdition() lacks an authorization check, letting any logged-in user invoke the route when the licensed edition mismatches.
Affected systems
Craft CMS 5.0.0 before 5.10.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Fix & remediation
Upgrade Craft CMS to version 5.10.14 or later. If patching immediately is not possible, block or restrict web requests to the AppController actionSwitchToLicensedEdition route at the reverse proxy or web server.
$ composer require craftcms/cms:"^5.10.14" --update-with-dependenciesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.