CVE-2026-109306: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Q: Which deployments are exposed to exploitation?

Craft CMS versions from 5.0.0 through versions before 5.10.14 are affected. Exploitation requires a mismatch involving the licensed edition.

Q: What level of access does an attacker need?

The attacker must be authenticated, but can be a low-privileged front-end user. No user interaction is required.

Q: What is the practical impact of a successful attack?

An attacker can persistently downgrade the installed site edition in project configuration. Administrators cannot reverse that change through the control panel.

Q: How can administrators determine whether exploitation may have occurred?

Review the installed edition and project configuration for an unexpected edition downgrade, particularly where the licensed edition mismatched. A downgraded edition that cannot be restored from the control panel is consistent with the described impact.

Published Oct 12, 2026

Updated

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

Affected Software

1 affected component

Craft CMS Craft CMS>=5.0.0<5.10.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Craft CMS to a version that resolves this vulnerability.
Fixed in 5.10.14

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to exploitation?

Craft CMS versions from 5.0.0 through versions before 5.10.14 are affected. Exploitation requires a mismatch involving the licensed edition.

What level of access does an attacker need?

The attacker must be authenticated, but can be a low-privileged front-end user. No user interaction is required.

What is the practical impact of a successful attack?

An attacker can persistently downgrade the installed site edition in project configuration. Administrators cannot reverse that change through the control panel.

How can administrators determine whether exploitation may have occurred?

Review the installed edition and project configuration for an unexpected edition downgrade, particularly where the licensed edition mismatched. A downgraded edition that cannot be restored from the control panel is consistent with the described impact.

CVE-2026-109306: Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to exploitation?

What level of access does an attacker need?

What is the practical impact of a successful attack?

How can administrators determine whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to exploitation?

What level of access does an attacker need?

What is the practical impact of a successful attack?

How can administrators determine whether exploitation may have occurred?