CVE-2026-33159: Craft CMS Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Summary
CVE-2026-33159: Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations. Affects craftcms/cms across 2 version ranges.
>= 4.0.0-RC1, < 4.17.8
>= 5.0.0-RC1, < 5.9.14
Fixed in 4.17.8 or 5.9.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a flexible content management system designed for building custom websites and applications. It offers a robust set of features, including a user-friendly control panel, a powerful templating engine, and a rich plugin ecosystem. However, a vulnerability exists that allows unauthenticated users to perform restricted operations related to project configuration synchronization, potentially compromising the integrity of the application.
Vulnerability Detail
The vulnerability arises from the ConfigSyncController, which extends the BaseUpdaterController. The base updater is accessible anonymously for control panel requests, allowing guest users to access the Config Sync updater index. This index emits signed updater state data that can be reused by guests in subsequent requests. Sensitive actions such as actionApplyYamlChanges and actionRegenerateYaml can be executed without authentication, leading to unauthorized configuration changes and posing a risk to service integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0-RC1, < 4.17.84.17.8composer require craftcms/cms:4.17.8 -
>= 5.0.0-RC1, < 5.9.145.9.14composer require craftcms/cms:5.9.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the Config Sync updater by implementing authentication checks or modifying access controls to prevent guest users from reaching the vulnerable endpoints.
Conclusion
The CVE-2026-33159 vulnerability in Craft CMS poses a significant risk by allowing unauthenticated users to perform restricted configuration sync operations. It is crucial to update to the latest patched versions to mitigate this risk and ensure the integrity of your application.
See every vulnerability recorded for craftcms/cms →
FAQ
CVE-2026-33159 is a vulnerability in Craft CMS that allows unauthenticated users to perform restricted project configuration sync operations.
Craft CMS versions 5.0.0-RC1 to 5.9.13 and 4.0.0-RC1 to 4.17.7 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability allows unauthorized configuration changes, which can lead to service integrity risks and unauthorized transitions in the application's configuration state.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
