Authorization Bypass Vulnerability in Craft CMS: Non-Admin Control Panel Users Can Reorder Global Sets
Summary
GHSA-rqjw-r5g4-x8qm: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9p7c-v5x3-rfx8. Affects craftcms/cms versions >= 4.0.0-RC1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Craft CMS is a flexible content management system designed for building websites and applications. It offers a user-friendly interface, robust features for content management, and a powerful templating engine. However, versions up to 4.18.0.1 are vulnerable to an authorization bypass issue that allows non-admin users to manipulate Global Sets inappropriately.
Vulnerability Detail
The vulnerability arises from a lack of proper authorization checks in the actionReorderSets function located in src/controllers/GlobalsController.php. This flaw allows unauthorized users to reorder Global Sets, which can lead to unauthorized changes in the content structure. The vulnerability can be exploited remotely, posing a risk to the integrity of the content managed by Craft CMS.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, restrict access to the control panel for non-admin users until the upgrade can be performed. This can be done by adjusting user permissions in the Craft CMS settings.
Conclusion
The authorization bypass vulnerability in Craft CMS allows non-admin users to reorder Global Sets, potentially compromising the integrity of the content. Upgrading to version 4.18.1 is essential to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for craftcms/cms →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Global Sets in Craft CMS are collections of content that can be reused across different sections of a website, allowing for consistent content management.
Yes, upgrading to Craft CMS version 4.18.1 or later will patch the vulnerability.
If an immediate upgrade is not possible, restrict access to the control panel for non-admin users as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
