CVE-2026-14793: A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets
A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. Upgrading to version 4.18.1 is able to address this issue. The patch is identified as 9bd05c91e6a7e6da5e949ec41a31c220c059aa04. The affected component should be upgraded.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-14793
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-147930.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-14793 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Craft CMS
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highGHSA-86vw-x4ww-x467: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreviewghsa · 2026-07-09
- lowGHSA-c43v-4cr8-6mvp: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file r…ghsa · 2026-07-09
- highGHSA-f74w-488g-8x5r: Craft CMS: Potential authenticated Remote Code Execution via referrer redirectghsa · 2026-07-06
- mediumGHSA-xrqc-p465-2xvg: Craft CMS: Stored XSS via Structure entry title in table viewghsa · 2026-07-06
- mediumGHSA-287w-mxq6-x2cp: Craft CMS: Sensitive File Disclosure / Server-Side File Readghsa · 2026-07-06
- highGHSA-24x4-j6x9-rfw5: Craft CMS: DOM XSS via GitHub issue title in CraftSupport widgetghsa · 2026-07-06
More from NVD Recent CVEs
- highCVE-2026-58281: Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized at…2026-07-11
- mediumCVE-2026-10660: The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assi…2026-07-11
- lowCVE-2026-61870: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memo…2026-07-11
- lowCVE-2026-61861: ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption…2026-07-11
- lowCVE-2026-61858: ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and ext…2026-07-11