Executive brief
Craft CMS, a popular content management system, contains a security flaw where certain users can perform administrative actions they are not authorized for. Specifically, users with access to the control panel but without full administrative rights can reorder 'Global Sets,' which are site-wide content containers. This could allow unauthorized staff to disrupt the intended structure or presentation of a website's global content.
Technical details
An improper authorization vulnerability (CWE-285) exists in Craft CMS versions 4.x prior to 4.18.1. The 'actionReorderSets' function within 'src/controllers/GlobalsController.php' failed to enforce administrative privilege checks. A remote attacker with low-level authenticated access to the control panel can exploit this by sending a crafted POST request to the reorder-sets endpoint to manipulate the order of Global Sets. The issue was resolved in version 4.18.1 by adding a 'requireAdmin()' check to the affected controller action.
Affected products
- Craft CMS Craft CMS >= 4.0.0-RC1, < 4.18.1
Timeline
- 2026-05-22: patched: Fixed in version 4.18.1
- 2026-07-06: disclosed: Initial advisory publication
- 2026-08-06: other: Advisory withdrawn as duplicate of GHSA-9p7c-v5x3-rfx8