CVE-2026-14794

Executive Summary

CVE-2026-14794 is an improper authorization vulnerability in Craft CMS versions up to and including 4.18.0.1. The flaw resides in the actionGetNewUsersData function within src/controllers/ChartsController.php of the Charts Endpoint. By manipulating the userGroupId argument, an unauthenticated remote attacker can bypass authorization checks, potentially gaining access to sensitive user data or performing unauthorized actions. The vulnerability is fixed in version 4.18.1 with a specific patch commit.

Supply Chain & Package Security

Craft CMS is a PHP-based content management system distributed via Composer. The vulnerability affects the core application, not a third-party plugin. Organizations should verify their Composer lock files and ensure they are not pinned to a vulnerable version. The patch is available in the official Craft CMS repository.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, the vulnerability can be assessed based on its characteristics:

• Attack Vector (AV): Network (remote exploitation possible)
• Attack Complexity (AC): Low (no special conditions required)
• Privileges Required (PR): None (unauthenticated)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (potential data exposure)
• Integrity (I): Low (limited modification possible)
• Availability (A): None

Estimated CVSS Score: 8.6 (High)

Threat Level: High. The vulnerability is remotely exploitable without authentication, making it attractive for attackers to enumerate user data or escalate privileges.

Deep Dive & Mechanics

The vulnerability is an improper authorization (CWE-285) in the Charts endpoint. The actionGetNewUsersData function in ChartsController.php is designed to return data about new users, filtered by user group. However, it fails to properly verify that the requesting user has permission to access data for the specified userGroupId. An attacker can send a crafted request with a manipulated userGroupId parameter to retrieve information about users in groups they should not have access to.

The attack flow:

1. The attacker sends a POST/GET request to the Charts endpoint with a userGroupId parameter.
2. The controller processes the request without checking if the current user (or unauthenticated session) is authorized to view data for that group.
3. The response returns user data, potentially including usernames, email addresses, or other sensitive information.

This is a classic authorization bypass where the application trusts the client-provided parameter without server-side validation.

Vulnerable vs. Patched Code

Vulnerable Code (simplified from src/controllers/ChartsController.php):

public function actionGetNewUsersData()
{
    $userGroupId = $this->request->getParam('userGroupId');
    // No authorization check for $userGroupId
    $data = $this->getUserDataByGroup($userGroupId);
    return $this->asJson($data);
}

Patched Code (after commit 9ee53efc1314e6aba32771c66a13e072a246f4ce):

public function actionGetNewUsersData()
{
    $userGroupId = $this->request->getParam('userGroupId');
    // Authorization check added
    if (!Craft::$app->getUser()->checkPermission('viewUserGroup:' . $userGroupId)) {
        throw new ForbiddenHttpException('Not authorized.');
    }
    $data = $this->getUserDataByGroup($userGroupId);
    return $this->asJson($data);
}

The patch adds a permission check using checkPermission to ensure the current user has the viewUserGroup permission for the requested group ID. This prevents unauthorized access.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable Craft CMS instance (version <= 4.18.0.1)
• Network access to the instance

Exploitation Steps:

1. Identify the Charts endpoint, typically at /index.php?p=admin/actions/charts/get-new-users-data or similar.
2. Send a request with a manipulated userGroupId:

curl -X POST "http://target.com/index.php?p=admin/actions/charts/get-new-users-data" \
  -d "userGroupId=2"

3. If the response returns user data (e.g., JSON with usernames), the vulnerability is confirmed.

Expected Response (vulnerable):

{
  "success": true,
  "data": [
    {"username": "admin", "email": "admin@example.com"},
    {"username": "editor", "email": "editor@example.com"}
  ]
}

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual requests to the Charts endpoint with varying userGroupId parameters.
2. Check logs for actionGetNewUsersData calls from unauthenticated or low-privileged users.
3. Verify that the patch is applied by checking the commit hash in the codebase.

Honeypot Setup:

• Deploy a decoy endpoint that mimics the vulnerable behavior and alerts on access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests to /index.php?p=admin/actions/charts/get-new-users-data with userGroupId parameter.
  • Unusual user enumeration patterns in access logs.
• File IOCs:
  • Presence of the vulnerable file src/controllers/ChartsController.php without the authorization check.
• Behavioral IOCs:
  • Unauthorized access to user data endpoints from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2026_14794_CraftCMS_Charts_AuthBypass {
    meta:
        description = "Detects vulnerable Craft CMS ChartsController.php with missing authorization check"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "9ee53efc1314e6aba32771c66a13e072a246f4ce"
    strings:
        $vuln_func = "actionGetNewUsersData"
        $vuln_param = "userGroupId"
        $no_auth = "getUserDataByGroup"
    condition:
        $vuln_func and $vuln_param and $no_auth and not for any of ($patch*) : ($patch*)
}

Sigma Rule

title: Craft CMS Charts Endpoint Authorization Bypass
id: 9ee53efc-1314-4e6a-b327-71c66a13e072
status: experimental
description: Detects exploitation attempts of CVE-2026-14794 via unauthorized access to Charts endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=charts/get-new-users-data'
        cs-uri-query|contains: 'userGroupId='
    condition: selection
falsepositives:
    - Legitimate admin requests
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-14794 Craft CMS Charts Endpoint Authorization Bypass";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"action=charts/get-new-users-data"; http_uri;
    content:"userGroupId="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Craft CMS to version 4.18.1 or later.
2. Apply the patch commit 9ee53efc1314e6aba32771c66a13e072a246f4ce if upgrading is not immediately possible.
3. Review access logs for any signs of exploitation.

Long-term Mitigations:

• Implement strict authorization checks for all API endpoints.
• Use Web Application Firewall (WAF) rules to block suspicious requests to the Charts endpoint.
• Conduct regular security audits of custom controllers.

Verification:

• After patching, confirm the fix by checking the ChartsController.php file for the added permission check.
• Test the endpoint with an unauthenticated request to ensure it returns a 403 Forbidden error.

Valters IT
Securing Digital Ecosystems