PT-2026-27464 · Craft Cms · Craft Cms

Gcxwlp · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33159

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description Craft CMS is a content management system. Guest users can access the Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication. The ConfigSyncController extends BaseUpdaterController, and the base updater is anonymously accessible for control panel requests. The index endpoint emits signed updater state (data), which can be reused by guests in subsequent requests. Sensitive actions reachable through this method include actionApplyYamlChanges, actionRegenerateYaml, applyExternalChanges, and regenerateExternalConfig. An attacker can send a POST request to /admin/actions/config-sync/index to extract the signed data, then reuse it in subsequent requests to endpoints like /admin/actions/config-sync/regenerate-yaml or /admin/actions/config-sync/apply-yaml-changes, potentially causing unauthorized configuration state transitions and a service integrity risk.

Recommendations Craft CMS versions 4.0.0-RC1 through 4.17.7 should be updated to version 4.17.8 or later. Craft CMS versions 5.0.0-RC1 through 5.9.13 should be updated to version 5.9.14 or later.

Exploit

Fix

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-862

CWE-306

Related Identifiers

CVE-2026-33159

GHSA-6MRR-Q3PJ-H53W

Affected Products

Craft Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33159.json · Exploit
• https://github.com/craftcms/cms/commit/7f0ead833f7c2b91ae12003caad833479dd08592 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-6mrr-q3pj-h53w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33159 · Security Note
• https://osv.dev/vulnerability/GHSA-6mrr-q3pj-h53w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33159 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Note
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Note