Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4.3, published 6 July 2026.

Which products and versions are affected?

craftcms/cms (Packagist) >= 4.0.0-RC1, < 4.18.1.

Is there a fix for This vulnerability?

A patch was published on 2026-05-22: Fixed in version 4.18.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Craft CMS improper authorization in GlobalsController reorder-sets endpoint

Q: Is there a fix for This vulnerability?

A patch was published on 2026-05-22: Fixed in version 4.18.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 4.3 · Published 2026-07-06

Craft CMS, a popular content management system, contains a security flaw where certain users can perform administrative actions they are not authorized for. Specifically, users with access to the control panel but without full administrative rights can reorder 'Global Sets,' which are site-wide content containers. This could allow unauthorized staff to disrupt the intended structure or presentation of a website's global content.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4.3, published 6 July 2026.
Which products and versions are affected?: craftcms/cms (Packagist) >= 4.0.0-RC1, < 4.18.1.
Is there a fix for This vulnerability?: A patch was published on 2026-05-22: Fixed in version 4.18.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285) exists in Craft CMS versions 4.x prior to 4.18.1. The 'actionReorderSets' function within 'src/controllers/GlobalsController.php' failed to enforce administrative privilege checks. A remote attacker with low-level authenticated access to the control panel can exploit this by sending a crafted POST request to the reorder-sets endpoint to manipulate the order of Global Sets. The issue was resolved in version 4.18.1 by adding a 'requireAdmin()' check to the affected controller action.

Affected products

Craft CMS Craft CMS >= 4.0.0-RC1, < 4.18.1

Timeline

2026-05-22: patched: Fixed in version 4.18.1
2026-07-06: disclosed: Initial advisory publication
2026-08-06: other: Advisory withdrawn as duplicate of GHSA-9p7c-v5x3-rfx8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.