CVE-2026-109306 — Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the …
Published: 2026-10-12 · CVSS: 6.0 · CVSS 4.0
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7