CVE-2026-109306Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Descripción

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-4wfw-q5w3-jh42) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition third-party-advisory