CVE-2026-14793

Executive Summary

CVE-2026-14793 is an authorization bypass vulnerability in Craft CMS versions up to 4.18.0.1. The flaw resides in the actionReorderSets function within src/controllers/GlobalsController.php, specifically in the reorder-sets endpoint. An unauthenticated remote attacker can exploit this to bypass authorization checks, potentially reordering global sets without proper permissions. The vulnerability is patched in version 4.18.1. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

Craft CMS is a PHP-based content management system distributed via Composer. The vulnerability affects the core application, not a third-party plugin. Organizations should verify their Composer lock files to ensure they are not pinned to a vulnerable version. The patch commit is publicly available in the Craft CMS repository.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description (remote, unauthenticated, authorization bypass), a reasonable assessment is:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – ability to reorder sets
• Availability Impact: None (A:N)

Estimated CVSS Score: 5.3 (Medium)

Threat Level: Medium. The vulnerability allows unauthorized reordering of global sets, which could disrupt content organization but does not directly lead to data exfiltration or system compromise.

Deep Dive & Mechanics

The vulnerability is in the actionReorderSets method of GlobalsController.php. This endpoint handles the reordering of global sets via a POST request to the reorder-sets action. The flaw is that the controller does not properly verify that the authenticated user has the necessary permissions to reorder global sets. In Craft CMS, global sets are managed by users with specific permissions (e.g., "editGlobalSet" or "manageGlobalSets"). The actionReorderSets function likely calls a service method that performs the reorder without checking the user's permissions, or the permission check is incorrectly implemented.

The attack is executed remotely by sending a crafted POST request to the vulnerable endpoint with the new order of global set IDs. Since no authentication is required (or the permission check is bypassed), any unauthenticated user can trigger the reorder.

Vulnerable vs. Patched Code

The patch commit 9bd05c91e6a7e6da5e949ec41a31c220c059aa04 addresses the issue by adding a proper authorization check before performing the reorder operation.

Vulnerable Code (simplified):

public function actionReorderSets(): Response
{
    $this->requirePostRequest();
    $ids = Json::decode($this->request->getRequiredBodyParam('ids'));
    Craft::$app->getGlobals()->reorderSets($ids);
    return $this->asSuccess();
}

Patched Code (simplified):

public function actionReorderSets(): Response
{
    $this->requirePostRequest();
    $this->requirePermission('manageGlobalSets'); // Added authorization check
    $ids = Json::decode($this->request->getRequiredBodyParam('ids'));
    Craft::$app->getGlobals()->reorderSets($ids);
    return $this->asSuccess();
}

The patched version adds a call to requirePermission('manageGlobalSets') which ensures only users with the appropriate permission can execute the action.

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, a manual exploitation approach is described.

Prerequisites:

• A vulnerable Craft CMS instance (version <= 4.18.0.1)
• Knowledge of valid global set IDs

Exploitation Steps:

1. Identify the vulnerable endpoint: /index.php?action=globals/reorder-sets
2. Craft a POST request with the ids parameter containing the desired order of global set IDs.
3. Send the request without authentication.

Example cURL command:

curl -X POST "http://target.com/index.php?action=globals/reorder-sets" \
  -d "ids=[1,3,2]"

Expected Outcome: The global sets are reordered according to the provided IDs, bypassing authorization.

Blue Team

Detection:

• Monitor for POST requests to /index.php?action=globals/reorder-sets from unauthenticated users.
• Look for anomalous patterns in the ids parameter (e.g., large arrays, unexpected values).
• Check web server logs for 200 responses to this endpoint without prior authentication.

Hunting:

• Search for requests to globals/reorder-sets in access logs.
• Correlate with authentication status (e.g., missing session cookie).
• Review database changes to the globalsets table for unexpected reorder timestamps.

Indicators of Compromise (IOCs)

• Network: POST requests to /index.php?action=globals/reorder-sets with ids parameter.
• Logs: Access log entries showing 200 status for the vulnerable endpoint without authentication.
• Database: Unauthorized changes to the sortOrder column in the globalsets table.
• File: No file-based IOCs expected.

Detection Engineering

YARA Rule

rule CVE_2026_14793_CraftCMS_ReorderSets {
    meta:
        description = "Detects exploitation attempts of CVE-2026-14793 in Craft CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14793"
    strings:
        $s1 = "action=globals/reorder-sets" nocase
        $s2 = "reorder-sets" nocase
        $s3 = "ids=" nocase
    condition:
        all of them
}

Sigma Rule

title: Craft CMS Authorization Bypass via reorder-sets Endpoint
id: cve-2026-14793
status: experimental
description: Detects unauthorized access to the reorder-sets endpoint in Craft CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=globals/reorder-sets'
    condition: selection
falsepositives:
    - Legitimate admin users with proper permissions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-14793 Craft CMS reorder-sets Authorization Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/index.php"; http_uri; content:"action=globals/reorder-sets"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Craft CMS to version 4.18.1 or later.
• Apply the patch commit 9bd05c91e6a7e6da5e949ec41a31c220c059aa04 if upgrading is not immediately possible.

Compensating Controls:

• Implement a Web Application Firewall (WAF) rule to block POST requests to /index.php?action=globals/reorder-sets from unauthenticated users.
• Restrict access to the admin panel via VPN or IP whitelisting.
• Monitor logs for suspicious activity targeting this endpoint.

Long-term:

• Conduct a security review of all controller actions to ensure proper authorization checks are in place.
• Implement automated security testing (SAST/DAST) in the CI/CD pipeline.

Valters IT – Securing Digital Frontiers