CVE-2026-14793: Authorization Bypass in Craft CMS GlobalsController actionReorderSets

Craft CMS utilizes "Global Sets" to manage site-wide variables and content modules. These components are handled through the administrative Control Panel (CP) via controllers designed to manage structural operations. The GlobalsController exposed a specific action route, actionReorderSets(), meant exclusively for system administrators to alter the sequential layout and prioritization of these global configurations.

This endpoint resides in the core routing configuration, rendering it accessible via POST requests directed to /actions/globals/reorder-sets or through query parameters like ?p=actions/globals/reorder-sets. However, in vulnerable versions up to 4.18.0.1, the application did not apply corresponding controller-level restriction mechanisms. Any authenticated session with basic CP access could access and invoke the endpoint.

This flaw falls under CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). While standard content management operations are segregated by user roles and specific permissions, this route bypassed administrative boundaries. Consequently, low-privilege users could modify the database and global configuration file sequences without proper credentials.

The root cause of CVE-2026-14793 lies in the omission of authorization checks within the execution pipeline of the controller method. Craft CMS controllers typically execute filter chains or explicit security checks before handling request parameters. Administrative controllers utilize the $this->requireAdmin() helper method to enforce that the current user context contains administrative privileges.

In the vulnerable configuration of GlobalsController.php, the action method actionReorderSets only enforced transport-layer constraints. It invoked $this->requirePostRequest() to ensure the request method was HTTP POST and $this->requireAcceptsJson() to enforce JSON transport format. However, it failed to perform user-level validation, allowing any authenticated session to reach the underlying service call.

Furthermore, the service layer function Craft::$app->getGlobals()->reorderSets() operates under the assumption that the calling context has already performed necessary authorization validation. This architectural pattern delegates boundary enforcement entirely to the controller layer. When a controller action fails to invoke $this->requireAdmin(), the underlying database operations run without validation, resulting in structural state updates.

Analysis of the vulnerable source code highlights the security gap in src/controllers/GlobalsController.php (commit f801317b13e4a87d704a50a2807a0af83325c452). The method lacked any checks validating the active user's permissions, directly invoking parameter extraction and service layer execution immediately after confirming transport validation.

// VULNERABLE CODE (<= 4.18.0.1)
public function actionReorderSets(): Response
{
    $this->requirePostRequest();
    $this->requireAcceptsJson();
 
    // Missing authorization check here
    $setIds = Json::decode($this->request->getRequiredBodyParam('ids'));
    Craft::$app->getGlobals()->reorderSets($setIds);
}

The function decodes the array of IDs sent in the request parameter ids and directly processes the update database sequence. Since there is no controller gate, the PHP pipeline proceeds blindly to the persistence layer.

// PATCHED CODE (>= 4.18.1 / 5.10.3)
public function actionReorderSets(): Response
{
    $this->requirePostRequest();
    $this->requireAcceptsJson();
    $this->requireAdmin(); // Enforces administrative context before execution
 
    $setIds = Json::decode($this->request->getRequiredBodyParam('ids'));
    Craft::$app->getGlobals()->reorderSets($setIds);
}

The integration of $this->requireAdmin() successfully forces execution flow verification against Yii2 session properties. If the user session lacks the active administrative flag, the application halts execution and outputs a 403 Forbidden JSON error block, neutralizing the bypass vector.

To exploit this vulnerability, an attacker must first obtain a valid, authenticated Control Panel session. This prerequisite restricts the attack surface to registered users, such as low-privileged editors, translators, or guest authors. Once logged in, the attacker can leverage the browser session's cookies and retrieve the current application-wide CSRF token from the Control Panel's DOM.

The attacker then crafts a direct POST request targeted at /index.php?p=actions/globals/reorder-sets. The request payload requires the parameter ids set to a JSON-formatted string array of integers representing the desired configuration order. This can be submitted either via standard application/x-www-form-urlencoded form encoding or application/json headers, containing the appropriate cookie and CSRF header.

POST /index.php?p=actions/globals/reorder-sets HTTP/1.1
Host: target-craftcms.local
User-Agent: Mozilla/5.0 (Security-Researcher)
Accept: application/json
Content-Type: application/json
Cookie: CraftSessionId=8abc01df823de7e123654;
X-CSRF-Token: your_csrf_token_here
Connection: close
 
{
  "ids": "[3,2,1]"
}

Upon processing, the backend decodes the requested layout sequence and modifies the database records. In environments where Craft CMS tracks configuration changes in files (Project Config), this action additionally writes state changes directly to the project configuration directory. These configuration modifications are then tracked by version control, potentially introducing persistence anomalies across deployments.

The direct impact of CVE-2026-14793 is categorized as partial loss of integrity. Because an unauthorized user can modify the sequential positioning of global content sets, the presentation layer of the public website may become distorted or unreadable. While this does not immediately allow remote code execution, manipulating application-wide variables can lead to secondary injection vectors if downstream template files process global attributes insecurely.

Additionally, Craft CMS utilizes a Project Config system to store structure and configuration in YAML files. The execution of the unauthorized global reordering triggers a serialization process that updates these configuration files on the local filesystem. In automated continuous integration pipelines, this modification could be committed to git, leading to configuration drift or pipeline failures.

Based on the CVSS v4.0 metrics, this vulnerability has a base score of 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N). The vulnerability requires basic user credentials (PR:L) but is executable remotely over the network with low complexity. This highlights the risk of privilege escalation within corporate content-management networks.

The primary remediation is to upgrade Craft CMS to version 4.18.1 (for 4.x installations) or 5.10.3 (for 5.x installations). These versions integrate the necessary role restriction check into the controller, securing the execution path. Organizations must apply the updates using Composer or the official Control Panel updater to ensure the patch is compiled into the codebase.

For environments where an immediate software upgrade is not feasible, administrators should audit and restrict Control Panel access. Disabling access to the Control Panel for all non-administrative users provides an effective temporary mitigation. Alternatively, custom access policies or Web Application Firewalls (WAF) can block requests targeting the specific URI path /actions/globals/reorder-sets for non-admin IP blocks.

This flaw underscores the importance of a defense-in-depth model in modern software architectures. Developers should implement security checks at both the controller boundary and the service layer. Relying solely on controllers to gate administrative functions introduces single points of failure, where an omitted helper call exposes the entire database layer to unauthorized manipulation.