What’s Vulnerable › Vulnerabilities

CVE-2026-109306: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-18
• Weakness: CWE-862

Description

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Affected products

• craftcms cms: from 5.0.0 before 5.10.14 — fixed in 5.10.14

How to fix

Upgrade to a fixed version: craftcms cms 5.10.14. Check the vendor advisory for mitigations.

References

• https://github.com/craftcms/cms/security/advisories/GHSA-4wfw-q5w3-jh42
• https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-missing-authorization-via-app-switch-to-licensed-edition

Get alerted when CVE-2026-109306 or the next vulnerability affects your stack