What is GHSA-g9xf-4797-9phm?

GHSA-g9xf-4797-9phm is a security advisory published by GitHub Security Advisories with Medium severity. Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in...

Which CVE IDs does GHSA-g9xf-4797-9phm cover?

GHSA-g9xf-4797-9phm covers the following CVE IDs: CVE-2026-109306. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g9xf-4797-9phm?

GHSA-g9xf-4797-9phm has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-g9xf-4797-9phmMediumCVSS 5.9

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-109306 →

📋 Description

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.

🔗 References (4)

https://github.com/craftcms/cms/security/advisories/GHSA-4wfw-q5w3-jh42
https://nvd.nist.gov/vuln/detail/CVE-2026-109306
https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.10.14-missing-authorization-via-app-switch-to-licensed-edition
https://github.com/advisories/GHSA-g9xf-4797-9phm