{"id":"CVE-2026-14793","aliases":["GHSA-9p7c-v5x3-rfx8"],"url":"https://o3.security/vulnerability/CVE-2026-14793","summary":"Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization","details":"The `reorder-sets` action in Craft CMS’s `GlobalsController` is missing the `requireAdmin()` check that the adjacent `save-set` and `delete-set` actions both enforce. Any authenticated control panel user can POST to `/actions/globals/reorder-sets` and permanently reorder all global sets in the project config, regardless of whether they have admin access. The reordering is written through to the project config and persists across requests.\n\n## Description\n\n`GlobalsController` exposes three administrative actions for managing global set structure. Two of them gate on admin status; the third does not.\n\n## Prerequisites\n\n- A Craft CMS instance with at least two global sets and a non-admin control panel user account.\n\n## Impact\n\nA non-admin control panel user can reorder all global sets. While this does not expose or modify content, reordering global sets modifies the project config -- a versioned artifact that is typically committed to source control and deployed across environments. An attacker can create noise in the project config history, trigger config-sync conflicts, or manipulate the display order seen by all editors in the admin panel. The same non-admin user cannot create or delete global sets because those actions correctly enforce `requireAdmin()`.","published":"2026-07-06T03:30:10.238Z","modified":"2026-10-28T02:30:39.810605274Z","cvss":null,"epss":{"score":0.00386,"percentile":0.32392,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.18.1"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.10.3"}],"fix":{"url":"https://github.com/craftcms/cms/commit/9bd05c91e6a7e6da5e949ec41a31c220c059aa04","label":"craftcms/cms@9bd05c9"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14793.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14793"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-14793"},{"type":"ADVISORY","url":"https://vuldb.com/submit/850792"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/376387"},{"type":"REPORT","url":"https://vuldb.com/vuln/376387/cti"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/9bd05c91e6a7e6da5e949ec41a31c220c059aa04"},{"type":"FIX","url":"https://github.com/craftcms/cms/releases/tag/4.18.1"},{"type":"WEB","url":"https://github.com/craftcms/cms/security/advisories/GHSA-9p7c-v5x3-rfx8"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"},{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.10.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:39.810605274Z"}}