{"uuid": "ac483a01-39cf-4880-b9fc-f01ff453f93a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RVMM-V933-JGXQ", "type": "seen", "source": "https://gist.github.com/alon710/44b00a029eb5e56bac1f996f02574592", "content": "# GHSA-RVMM-V933-JGXQ: GHSA-rvmm-v933-jgxq: Missing Authorization Check in Craft CMS ChartsController\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-RVMM-V933-JGXQ\n\n## Summary\nAn authorization bypass vulnerability in Craft CMS allows unauthenticated or low-privileged users to query and obtain sensitive time-series user registration counts and demographic metrics. This is due to a missing authorization check inside the actionGetNewUsersData endpoint of the ChartsController class.\n\n## TL;DR\nMissing authorization in Craft CMS ChartsController allowed unauthorized access to sensitive time-series user metrics and registration demographics via `/actions/charts/get-new-users-data` prior to versions 4.18.1 and 5.10.3.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS**: 5.3 (Medium)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Craft CMS\n- **Craft CMS**: >= 4.0.0-RC1, < 4.18.1 (Fixed in: `4.18.1`)\n- **Craft CMS**: >= 5.0.0-RC1, < 5.10.3 (Fixed in: `5.10.3`)\n\n## Mitigation\n\n- Upgrade Craft CMS instances to patched versions 4.18.1 or 5.10.3 immediately.\n- Enforce context routing constraints on custom controllers.\n- Implement restrictive Web Application Firewall (WAF) policies for sensitive action endpoints.\n\n**Remediation Steps:**\n1. Navigate to the project root directory.\n2. Execute `composer update craftcms/cms` to fetch the latest secure release.\n3. Verify that requests to `/actions/charts/get-new-users-data` without a valid Control Panel session return a 400 Bad Request or redirect to login.\n4. Audit logs for legacy unauthenticated POST requests targeting `charts/get-new-users-data`.\n\n## References\n\n- [GitHub Security Advisory GHSA-rvmm-v933-jgxq](https://github.com/craftcms/cms/security/advisories/GHSA-rvmm-v933-jgxq)\n- [Raw Code Patch File](https://github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4ce.patch)\n- [Craft CMS Core Repository](https://github.com/craftcms/cms)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RVMM-V933-JGXQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T01:35:03.998833Z"}