Medium severity · published Jul 6, 2026
CVE-2026-14793
Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. Upgrading to version 4.18.1 is able to address this issue. The patch is identified as 9bd05c91e6a7e6da5e949ec41a31c220c059aa04. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMS · Craft
4.18.0.0; 4.18.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14793
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14793
github.com
https://github.com/craftcms/cms/commit/9bd05c91e6a7e6da5e949ec41a31c220c059aa04
github.com
https://github.com/craftcms/cms/releases/tag/4.18.1
vuldb.com
https://vuldb.com/cve/CVE-2026-14793
vuldb.com
https://vuldb.com/submit/850792
vuldb.com
https://vuldb.com/vuln/376387
vuldb.com
https://vuldb.com/vuln/376387/cti
More from CMS
5.3
CVE-2025-35939
Craft CMS stores user-provided content in session files
4.3
CVE-2026-14794
Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization