CVE-2026-109306Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Description

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• GitHub Security Advisory (GHSA-4wfw-q5w3-jh42) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition third-party-advisory