SB2026110648 - Multiple vulnerabilities in Craft CMS

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated control panel user to read aggregate user-registration counts and totals in Craft CMS without permission to view users.

The vulnerability exists due to a missing viewUsers authorization check in the /actions/charts/get-new-users-data endpoint when handling requests from control panel accounts. An authenticated control panel user can send a POST request to retrieve registration time series for the entire site or an arbitrary user group.

2) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker with no additional permissions to read sensitive database contents in Craft CMS.

The vulnerability exists due to address controllers passing unsanitized nested request arrays into Element::findOne() as query criteria, enabling SQL injection. An authenticated attacker with no additional permissions can submit crafted address requests to extract data through blind SQL injection before ownership checks, with at least one address row required for reliable time-based extraction.

Remediation

Install update from vendor's website.

References

• https://github.com/craftcms/cms/security/advisories/GHSA-4rg3-m2h8-grqw
• https://github.com/craftcms/cms/security/advisories/GHSA-cphx-cx67-jcqj