{"metadata": {"vulnerability": "CVE-2026-109306", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-22T00:00:00Z", "date_only": false, "value": "2026-09-22T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109306", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:13:39.027Z", "date_only": false, "value": "2026-10-12T14:13:39.027Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109306", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:05:03.382Z", "date_only": false, "value": "2026-10-12T16:05:03.382Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109306", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T16:05:03.382Z", "date_only": false, "value": "2026-10-12T16:05:03.382Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109306", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T16:05:03.382Z", "date_only": false, "value": "2026-10-12T16:05:03.382Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109306", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T17:13:13.650Z", "date_only": false, "value": "2026-10-12T17:13:13.650725Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429055862476015", "record": "CVE-2026-109306", "field": "creation_timestamp", "uuid": "b9308eb0-adcf-4dc8-8c5e-3d5efb3703ed", "content": "CVE-2026-109306 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109306https://github.com/craftcms/cms/security/advisories/GHSA-4wfw-q5w3-jh42https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-missing-authorization-via-app-switch-to-licensed-edition#craftcms #cms#CVE_2026_109306#bot", "url": "https://infosec.exchange/users/cve/statuses/117429055862476015"}, {"timestamp": "2026-10-12T17:17:24Z", "date_only": false, "value": "2026-10-12T17:17:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G9XF-4797-9PHM", "record": "GHSA-G9XF-4797-9PHM", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T17:17:24.923Z", "date_only": false, "value": "2026-10-12T17:17:24.923", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109306", "record": "FKIE_CVE-2026-109306", "field": "published"}, {"timestamp": "2026-10-12T17:17:24.923Z", "date_only": false, "value": "2026-10-12T17:17:24.923", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109306", "record": "FKIE_CVE-2026-109306", "field": "lastModified"}, {"timestamp": "2026-10-12T18:31:47Z", "date_only": false, "value": "2026-10-12T18:31:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G9XF-4797-9PHM", "record": "GHSA-G9XF-4797-9PHM", "field": "published"}, {"timestamp": "2026-10-12T18:31:47Z", "date_only": false, "value": "2026-10-12T18:31:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G9XF-4797-9PHM", "record": "GHSA-G9XF-4797-9PHM", "field": "modified"}]}