https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T17:01:31.024828+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333259 EUVD-2026-333259 2026-10-07T17:01:31.091784+00:00 EUVD-2026-333259 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14794 fkie_cve-2026-14794 2026-10-07T17:01:31.091824+00:00

A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.

 https://cve.radiocsirt.org/vuln/ghsa-rvmm-v933-jgxq GHSA-rvmm-v933-jgxq — Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics 2026-10-07T17:01:31.091857+00:00

Affected: Packagist: craftcms/cms

`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('viewUsers')` authorization check. Any authenticated control panel user, regardless of permissions beyond `accessCp`, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.

The `viewUsers` permission is consistently required throughout the control panel before exposing user-related data, but this action enforces only the base `accessCp` check inherited from the framework.

Each call returns the total count of users who joined the specified group in the requested period.

## Impact

Any control panel user with only `accessCp` permission can obtain the total number of registered users and their registration date distribution across any time window.

In installations with multiple editor roles, this allows a low-privilege control panel user to infer user group sizes and registration trends that would normally require the `viewUsers` permission to access.

No user PII (name, email, password) is disclosed; only aggregate counts and timestamps are returned. Confidentiality impact is low. No integrity or availability impact.