https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T13:18:54.329188+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277236 EUVD-2026-277236 2026-10-14T13:18:54.380943+00:00 EUVD-2026-277236 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33159 fkie_cve-2026-33159 2026-10-14T13:18:54.380977+00:00

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication. This issue has been patched in versions 4.17.8 and 5.9.14.

 https://cve.radiocsirt.org/vuln/ghsa-6mrr-q3pj-h53w GHSA-6mrr-q3pj-h53w — Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations 2026-10-14T13:18:54.381009+00:00

Affected: Packagist: craftcms/cms

### Summary Guest users can access Config Sync updater `index`, obtain signed `data`, and execute state-changing Config Sync actions (`regenerate-yaml`, `apply-yaml-changes`) without authentication.

### Details

`ConfigSyncController` extends `BaseUpdaterController`, and the base updater is anonymously accessible for control panel requests. `index` emits signed updater state (`data`), which can be reused by guests in subsequent requests.

Sensitive actions that are reachable via this method are `actionApplyYamlChanges`, `actionRegenerateYaml`, `applyExternalChanges`, and `regenerateExternalConfig`.

#### Reproduction steps

1. Guest POST to:

http POST /admin/actions/config-sync/index

2. Extract data from returned JS state:

Craft.updater = ... setState({"data":"<signedData>", ...});

3. Reuse data as a guest:

``` POST /admin/actions/config-sync/regenerate-yaml data=<signedData>&<csrfParam>=<csrfToken> ```

or

``` POST /admin/actions/config-sync/apply-yaml-changes data=<signedData>&<csrfParam>=<csrfToken> ```

4. Observe completed response and state/file changes.

### Impact

Unauthenticated users can execute project configuration sync operations that should be restricted to trusted admin/deployment contexts.

Depending on the pending YAML/config state, this can cause unauthorized config state transitions and a service integrity risk.

### Resources

https://github.com/craftcms/cms/commit/7f0ead833f7