Skip to content

CVE record · 1 source

CVE-2026-109306

CVSS 5.9

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any…

Vendor: Craft CMS
Product: Craft CMS
CVSS: 5.9
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

8

CVE NVD 19d ago

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any…

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users…

CVSS 5.9 CVE-2026-109306 Craft CMS