CVE-2026-109306 | BDVDB-2026-386352 Detail

Description#

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-12Record published in the CVE List.
2. Version 22026-10-18Most recent update recorded in the CVE List.