CVE-2026-14794: Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization
A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMS Charts Endpoint (ChartsController.php actionGetNewUsersData)to a version that resolves this vulnerability.Fixed in 4.18.1Patch 9ee53efc1314e6aba32771c66a13e072a246f4ce
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14794?
The severity of CVE-2026-14794 is rated medium with a score of 4.3.
How do I fix CVE-2026-14794?
To fix CVE-2026-14794, ensure that proper authorization checks are implemented in the actionGetNewUsersData function of ChartsController.php.
What does CVE-2026-14794 affect?
CVE-2026-14794 affects the Craft CMS up to version 4.18.0.1, specifically the Charts Endpoint component.
What type of vulnerability is CVE-2026-14794?
CVE-2026-14794 is classified as an improper authorization vulnerability.
What components are involved in CVE-2026-14794?
CVE-2026-14794 involves the ChartsController.php file within the Charts Endpoint of Craft CMS.