https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T19:26:47.375170+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-109306 CVE-2026-109306 — Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition 2026-10-15T19:26:47.376016+00:00

Affected: craftcms cms

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.