CVE-2026-14794: Craft CMS improper authorization in Charts Endpoint

Executive brief

Craft CMS, a popular content management system, contains a security flaw in its charting component. An authenticated user could potentially bypass authorization checks to view user data they are not permitted to see. This could lead to the unauthorized disclosure of internal user group information.

Technical details

An improper authorization vulnerability (CWE-285/CWE-266) exists in Craft CMS up to version 4.18.0.1. The flaw is located in the actionGetNewUsersData function within src/controllers/ChartsController.php. By manipulating the userGroupId argument, a remote attacker with low-level authenticated access can bypass intended authorization restrictions to retrieve data from the Charts Endpoint. The issue is addressed in version 4.18.1 by improving authorization checks within the affected controller.

Affected products

• Craft CMS up to 4.18.0.1

Timeline

• 2026-05-22: patched: Version 4.18.1 released
• 2026-07-06: disclosed: NVD publication date

References

• https://github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4ce
• https://github.com/craftcms/cms/releases/tag/4.18.1
• https://vuldb.com/cve/CVE-2026-14794
• https://vuldb.com/submit/850793
• https://vuldb.com/vuln/376388
• https://vuldb.com/vuln/376388/cti