CVE-2026-109306
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.