Executive brief
Craft CMS is a popular content management system used to build and manage websites. A vulnerability in its charting feature allows logged-in non-admin users to bypass authorization checks and view sensitive user registration metrics they should not have access to. While this does not allow data modification or system disruption, it exposes confidential analytics data that could inform attacks or expose business intelligence.
Technical details
The vulnerability is a missing authorization check (CWE-266) in the actionGetNewUsersData function within src/controllers/ChartsController.php. An authenticated non-admin control panel user can manipulate the userGroupId argument to bypass authorization logic and retrieve user registration metrics from arbitrary user groups. Attack vector is network-based over HTTP/HTTPS with low attack complexity, requiring only low privileges (a valid non-admin user account) and no user interaction. No integrity or availability impact; the attack results in confidentiality loss (unauthorized data disclosure). The issue is patched in Craft CMS 4.18.1 and 5.10.3, with fix committed as 9ee53efc1314e6aba32771c66a13e072a246f4ce.
Affected products
- Craft CMS Craft CMS 4.0.0-RC1 to 4.18.0.1; 5.0.0-RC1 to 5.10.2
Timeline
- 2026-07-06: disclosed: Advisory published to GitHub Advisory Database
- 2026-05-22: patched: Patch released in versions 4.18.1 and 5.10.3
- 2026-08-31: other: Advisory withdrawn as duplicate of GHSA-rvmm-v933-jgxq