CVE-2026-33159: Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
Summary Guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication.
Details
ConfigSyncController extends BaseUpdaterController, and the base updater is anonymously accessible for control panel requests. index emits signed updater state (data), which can be reused by guests in subsequent requests.
Sensitive actions that are reachable via this method are actionApplyYamlChanges, actionRegenerateYaml, applyExternalChanges, and regenerateExternalConfig.
Reproduction steps
1. Guest POST to:
http POST /admin/actions/config-sync/index
2. Extract data from returned JS state:
Craft.updater = ... setState({"data":"<signedData>", ...});
3. Reuse data as a guest:
POST /admin/actions/config-sync/regenerate-yaml data=<signedData>&<csrfParam>=<csrfToken>
or
POST /admin/actions/config-sync/apply-yaml-changes data=<signedData>&<csrfParam>=<csrfToken>
4. Observe completed response and state/file changes.
Impact
Unauthenticated users can execute project configuration sync operations that should be restricted to trusted admin/deployment contexts.
Depending on the pending YAML/config state, this can cause unauthorized config state transitions and a service integrity risk.
Resources
https://github.com/craftcms/cms/commit/7f0ead833f7
Other sources
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication. This issue has been patched in versions 4.17.8 and 5.9.14.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33159?
CVE-2026-33159 has a high severity rating due to the potential for unauthenticated users to perform critical configuration changes.
How do I fix CVE-2026-33159?
To fix CVE-2026-33159, upgrade Craft CMS to version 4.17.8 or 5.9.14.
What operations are affected by CVE-2026-33159?
CVE-2026-33159 allows unauthenticated users to execute project configuration sync operations, such as regenerating YAML and applying YAML changes.
Which versions of Craft CMS are vulnerable to CVE-2026-33159?
Craft CMS versions 4.0.0-RC1 to 4.17.7 and 5.0.0-RC1 to 5.9.13 are vulnerable to CVE-2026-33159.
Who can exploit CVE-2026-33159?
CVE-2026-33159 can be exploited by guest users who are not authenticated.