{"id":"CVE-2026-14794","aliases":["GHSA-rvmm-v933-jgxq"],"url":"https://o3.security/vulnerability/CVE-2026-14794","summary":"Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization","details":"`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('viewUsers')` authorization check. Any authenticated control panel user, regardless of permissions beyond `accessCp`, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.\n\nThe `viewUsers` permission is consistently required throughout the control panel before exposing user-related data, but this action enforces only the base `accessCp` check inherited from the framework.\n\nEach call returns the total count of users who joined the specified group in the requested period.\n\n## Impact\n\nAny control panel user with only `accessCp` permission can obtain the total number of registered users and their registration date distribution across any time window.\n\nIn installations with multiple editor roles, this allows a low-privilege control panel user to infer user group sizes and registration trends that would normally require the `viewUsers` permission to access.\n\nNo user PII (name, email, password) is disclosed; only aggregate counts and timestamps are returned. Confidentiality impact is low. No integrity or availability impact.","published":"2026-07-06T03:45:09.182Z","modified":"2026-08-31T19:55:39.383107784Z","cvss":null,"epss":{"score":0.00385,"percentile":0.32309,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.18.1"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.10.3"}],"fix":{"url":"https://github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4ce","label":"craftcms/cms@9ee53ef"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14794.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14794"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-14794"},{"type":"ADVISORY","url":"https://vuldb.com/submit/850793"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/376388"},{"type":"REPORT","url":"https://vuldb.com/vuln/376388/cti"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4ce"},{"type":"FIX","url":"https://github.com/craftcms/cms/releases/tag/4.18.1"},{"type":"WEB","url":"https://github.com/craftcms/cms/security/advisories/GHSA-rvmm-v933-jgxq"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"},{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.10.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-31T19:55:39.383107784Z"}}