{"id":"GHSA-rvmm-v933-jgxq","title":"Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics","summary":"Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics","severity":"medium","cwe":["CWE-862"],"vendor":"craftcms","product":"craftcms/cms","ecosystem":"composer","affected":["craftcms/cms >= 4.0.0-RC1, < 4.18.1","craftcms/cms >= 5.0.0-RC1, < 5.10.3"],"patched":["craftcms/cms 4.18.1","craftcms/cms 5.10.3"],"published":"2026-08-06","updated":"2026-08-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rvmm-v933-jgxq","references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-rvmm-v933-jgxq"},{"url":"https://github.com/craftcms/cms/commit/9ee53efc1314e6aba32771c66a13e072a246f4ce"},{"url":"https://github.com/craftcms/cms/releases/tag/4.18.1"},{"url":"https://github.com/craftcms/cms/releases/tag/5.10.3"},{"url":"https://github.com/advisories/GHSA-rvmm-v933-jgxq"}],"tags":["ghsa","composer"],"ingestedAt":"2026-08-06T22:05:23.089Z","slug":"GHSA-rvmm-v933-jgxq","body":"## Overview\n\n`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('viewUsers')` authorization check. Any authenticated control panel user, regardless of permissions beyond `accessCp`, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.\n\nThe `viewUsers` permission is consistently required throughout the control panel before exposing user-related data, but this action enforces only the base `accessCp` check inherited from the framework.\n\nEach call returns the total count of users who joined the specified group in the requested period.\n\n## Impact\n\nAny control panel user with only `accessCp` permission can obtain the total number of registered users and their registration date distribution across any time window.\n\nIn installations with multiple editor roles, this allows a low-privilege control panel user to infer user group sizes and registration trends that would normally require the `viewUsers` permission to access.\n\nNo user PII (name, email, password) is disclosed; only aggregate counts and timestamps are returned. Confidentiality impact is low. No integrity or availability impact.\n\n## Affected packages\n\n- `craftcms/cms >= 4.0.0-RC1, < 4.18.1`\n- `craftcms/cms >= 5.0.0-RC1, < 5.10.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `craftcms/cms 4.18.1`\n- `craftcms/cms 5.10.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}