CVE-2026-14794
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A flaw in Craft CMS up to version 4.18.0.1 affects the Charts endpoint. The actionGetNewUsersData function in ChartsController.php improperly authorizes access via the userGroupId argument, allowing unauthorized actions. The attack can be carried out remotely.
Risk Assessment
The organization is at risk of unauthorized access to user data, potentially leading to information disclosure or system confidentiality breaches.
Recommendation
Immediately upgrade Craft CMS to version 4.18.1 or later, which includes the fix (commit 9ee53efc1314e6aba32771c66a13e072a246f4ce).
Original NVD description (English source)
A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.