CVE-2026-109306 in Craft CMS
Summary
by MITRE • 10/12/2026
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within Craft CMS versions prior to 5.10.14 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw resides within the AppController::actionSwitchToLicensedEdition() function, which is designed to manage transitions between different licensing tiers of the content management system. The core technical issue stems from an insufficient verification of user privileges when executing this action route. While the application correctly restricts certain administrative functions based on role-based access control, it fails to validate whether the authenticated user initiating the switch possesses the necessary elevated permissions required for modifying license configurations. Consequently, any authenticated user, including those with low-privileged front-end roles such as subscribers or contributors, can invoke this endpoint under specific conditions where a licensed edition mismatch exists in the system state.
The operational impact of this vulnerability is severe due to its persistent nature and the difficulty of remediation by administrators. When an attacker exploits this flaw, they are able to downgrade the installed edition of Craft CMS from a paid or enterprise tier back to a free or lower-tier version. This action modifies the project configuration files that define the system's operational parameters. Crucially, once this downgrading occurs through the vulnerable endpoint, the change is persisted in the project config structure. Standard administrative interfaces and control panels do not provide an immediate mechanism to reverse this specific type of configuration alteration because the system interprets the modified state as a valid user-initiated action rather than a malicious manipulation. This creates a situation where site administrators are locked out from their licensed features without a straightforward recovery path, effectively disrupting business operations that rely on premium functionalities such as advanced SEO tools, multi-site management capabilities, or priority support integrations.
From an attacker perspective, this vulnerability aligns with the ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate credentials to gain unauthorized access and modify system configurations. The exploitation does not require complex privilege escalation exploits beyond what is already granted by a standard user account, making it highly accessible for opportunistic attacks or targeted disruptions against organizations using Craft CMS. The ability to downgrade the edition can lead to data integrity issues if features dependent on higher-tier licenses are suddenly disabled while content remains in a state expecting those features. Furthermore, this could be used as an initial vector for further exploitation if certain security controls tied to the licensed version are bypassed or altered during the downgrading process.
Mitigation strategies must focus on immediate patching and rigorous access control reviews. The primary remediation is to upgrade Craft CMS to version 5.10.14 or later, where this authorization check has been corrected to ensure that only users with explicit administrative privileges can switch licensed editions. In the interim, before patches are applied, administrators should restrict public-facing access to backend API endpoints and implement strict firewall rules that limit exposure of internal application routes. Additionally, implementing Web Application Firewall (WAF) signatures to detect attempts to call actionSwitchToLicensedEdition from non-administrative IP ranges or user agents can provide a layer of defense. Regular audits of project configuration files are also recommended to quickly identify any unauthorized changes and restore them manually if the vulnerability has been exploited in an unpatched environment.