Medium severity4.3NVD Advisory· Published Jul 6, 2026· Updated Jul 6, 2026
CVE-2026-14794
CVE-2026-14794
Description
A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
craftcms/cmsPackagist | >= 4.0.0-RC1, < 4.18.1 | 4.18.1 |
craftcms/cmsPackagist | >= 5.0.0-RC1, < 5.10.3 | 5.10.3 |
Affected products
2- Range: <=4.18.0.1
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-rvmm-v933-jgxqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-14794ghsaADVISORY
- github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4cenvdWEB
- github.com/craftcms/cms/releases/tag/4.18.1nvdWEB
- github.com/craftcms/cms/releases/tag/5.10.3ghsaWEB
- github.com/craftcms/cms/security/advisories/GHSA-rvmm-v933-jgxqghsaWEB
- vuldb.com/cve/CVE-2026-14794nvdWEB
- vuldb.com/submit/850793nvdWEB
- vuldb.com/vuln/376388nvdWEB
- vuldb.com/vuln/376388/ctinvd
News mentions
0No linked articles in our index yet.