Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-33159: Craft CMS lets unauthenticated users change configuration
CVE-2026-33159 · published 7 months ago
Summary
In certain older versions of Craft CMS, anyone on the internet could reach the Config Sync feature, see signed configuration data, and trigger changes without logging in. This could let attackers modify site settings or content structures. Upgrade to the latest release of Craft CMS to close the gap.
What to do
- Update craftcms cms to version 5.9.14.
- Update craftcms cms to version 4.17.8.
- Update craftcms craftcms/cms to version 5.9.14.
- Update craftcms craftcms/cms to version 4.17.8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | craftcms | cms |
>= 5.0.0-RC1, <= 5.9.13 >= 4.0.0-RC1, <= 4.17.7 Fix: upgrade to 5.9.14
|
| Packagist | craftcms | craftcms/cms |
>= 5.0.0-RC1, < 5.9.14 >= 4.0.0-RC1, < 4.17.8 Fix: upgrade to 5.9.14
|
| – | craftcms | craft_cms |
> 4.0.0, < 4.17.8 > 5.0.0, < 5.9.14 4.0.0 5.0.0 cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* |
Original advisory text
Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication. This issue has been patched in versions 4.17.8 and 5.9.14.
References
- https://github.com/craftcms/cms/releases/tag/4.17.8 URL
- https://github.com/craftcms/cms/releases/tag/5.9.14 URL
- https://github.com/craftcms/cms/commit/7f0ead833f7c2b91ae12003caad833479dd08592 Patch
- https://github.com/advisories/GHSA-6mrr-q3pj-h53w
- https://github.com/craftcms/cms Product
- https://github.com/craftcms/cms/security/advisories/GHSA-6mrr-q3pj-h53w Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33159... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33159 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.1
High
Type
CWE-306Missing Authentication for Critical Function
CWE-862Missing Authorization
Timeline
Published24 Mar 2026
Updated4 Nov 2026
First seen24 Mar 2026
Sources
GHSA-6mrr-q3pj-h53w · GHSA
CVE-2026-33159 · NVD
GHSA-6mrr-q3pj-h53w · OSV
CVE-2026-33159 · OSV
Track software like this
Free during beta