{"action":"Upgrade craftcms/cms to 4.18.1 or later.","affected":[{"fixed":"4.18.1","introduced":"4.0.0-RC1"},{"fixed":"5.10.3","introduced":"5.0.0-RC1"}],"component":"craftcms/cms","cve_ids":["CVE-2026-14793"],"ecosystem":"Packagist","epss":0.00386,"exploited":false,"fixed_versions":["4.18.1","5.10.3"],"ghsa_id":"GHSA-9p7c-v5x3-rfx8","id":"tcs_01M5KF06SJMCQM2TFPP1AMRBMB","modified_at":"2026-08-06T21:11:02.756402Z","published_at":"2026-08-06T20:55:48Z","references":["https://osv.dev/vulnerability/GHSA-9p7c-v5x3-rfx8","https://github.com/craftcms/cms/security/advisories/GHSA-9p7c-v5x3-rfx8","https://nvd.nist.gov/vuln/detail/CVE-2026-14793","https://github.com/craftcms/cms/commit/9bd05c91e6a7e6da5e949ec41a31c220c059aa04","https://github.com/craftcms/cms","https://github.com/craftcms/cms/releases/tag/4.18.1","https://github.com/craftcms/cms/releases/tag/5.10.3","https://vuldb.com/cve/CVE-2026-14793","https://vuldb.com/submit/850792","https://vuldb.com/vuln/376387"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-9p7c-v5x3-rfx8","url":"https://osv.dev/vulnerability/GHSA-9p7c-v5x3-rfx8"}],"summary":"Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets"}