{"id":"CVE-2026-109306","summary":"Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition","details":"Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.","aliases":["GHSA-4wfw-q5w3-jh42"],"modified":"2026-10-14T02:47:40.846041370Z","published":"2026-10-12T16:05:03.382Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109306.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109306.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-4wfw-q5w3-jh42"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109306"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-missing-authorization-via-app-switch-to-licensed-edition"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/craftcms/cms","events":[{"introduced":"f6a8fb685d44e387435825e3a96809eeda4973a6"},{"fixed":"6804f92fbdd93c3a3fb40f15bcd76a406e97634d"}],"database_specific":{"extracted_events":[{"introduced":"5.0.0"},{"fixed":"5.10.14"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109306.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}