CVE-2026-109306
Last modified
CVE-2026-109306 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel..
Description
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| craftcms | cms | >= 5.0.0, < 5.10.14 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-109306?
How severe is CVE-2026-109306?
How do I fix CVE-2026-109306?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-109300Open WebUI from 0.6.31 before 0.11.4 contains a stored cross…4.6
- CVE-2026-109301Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 d…5.9
- CVE-2026-109302Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alp…3.7
- CVE-2026-109303Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 …4.3
- CVE-2026-109304Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 conta…4.9
- CVE-2026-109305Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox…8.8
- CVE-2026-109307Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-si…4.7
- CVE-2026-109308Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passe…8.8
- CVE-2026-109309SiYuan v3.7.0 before v3.8.6 contains an absolute path traver…6.5
- CVE-2026-10931Use after free in FileSystem in Google Chrome prior to 149.0…9.6
- CVE-2026-109310SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig tem…6.5
- CVE-2026-109311vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg …6.5
Are you affected by CVE-2026-109306?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST