Junglewise Threat Intelligence

Craft CMS missing authorization check in ChartsController

Severity: medium · CVSS 5.3 · Published 2026-08-06

Executive brief

Craft CMS, a popular content management system, contains a flaw where low-privileged users can access sensitive site metrics. Specifically, users who should only have basic access to the control panel can view user registration trends and group sizes that are normally restricted to administrators. While individual user details like names or passwords are not exposed, this allows unauthorized staff to see internal growth data and user distribution.

Technical details

A missing authorization check (CWE-862) exists in the `ChartsController::actionGetNewUsersData()` method at the `/actions/charts/get-new-users-data` endpoint. While the control panel typically requires the `viewUsers` permission to access user-related data, this specific endpoint only enforced the base `accessCp` check. An authenticated attacker with low-level control panel access can send a POST request to this endpoint to retrieve time-series user registration counts for the entire site or specific user groups. The vulnerability has been patched in versions 4.18.1 and 5.10.3 by adding the necessary permission requirements.

Affected products

  • Craft CMS CMS >= 4.0.0-RC1, < 4.18.1; >= 5.0.0-RC1, < 5.10.3

Timeline

  • 2026-05-22: patched: Versions 4.18.1 and 5.10.3 released
  • 2026-07-25: disclosed: Initial advisory publication
  • 2026-08-06: advisory: GitHub Advisory reviewed and published

References