CVE-2026-14794

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-14794

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14794.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-14794

Published

2026-07-06T03:45:09.182Z

Modified

2026-07-15T01:49:08.460560113Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

Details

A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.

Database specific

{
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14794.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.18.0.0"
                },
                {
                    "last_affected": "4.18.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

f801317b13e4a87d704a50a2807a0af83325c452

Fixed

9ee53efc1314e6aba32771c66a13e072a246f4ce

Fixed

7896d0ec2bd9deaa7809404604f00b949f208afa

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.18.0.1"
        },
        {
            "last_affected": "4.18.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*

4.18.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14794.json"