CVE-2026-109306
Received Received - Intake

Craft CMS Edition Downgrade via Missing Authorization

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109306
EUVD
EUVD-2026-97608

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms cms 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS versions 5.0.0 to 5.10.13 have a missing authorization flaw in the AppController::actionSwitchToLicensedEdition() function. This allows any authenticated user, even low-privileged front-end users, to downgrade the installed edition of the CMS by exploiting a route action. The downgrade persists in the project config, making it irreversible through the control panel.

Detection Guidance

Check Craft CMS version with 'composer show craftcms/cms' or in the control panel. Look for unauthorized edition changes in project config files or admin logs.

Impact Analysis

An attacker with basic access could downgrade your Craft CMS edition, potentially disabling premium features, breaking functionality, or exposing sensitive data. Admins cannot reverse this change via the control panel, requiring manual intervention to restore the correct edition.

Compliance Impact

This vulnerability allows unauthorized users to downgrade the Craft CMS edition, potentially altering system functionality or access controls. For GDPR, this could impact data integrity and access management if the downgrade disables security features. For HIPAA, unauthorized changes to system settings might violate access control requirements. However, the specific compliance impact depends on how the CMS is configured and used.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.14 or later immediately. Review project config for unauthorized edition changes and restore from a clean backup if compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart