GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-rvmm-v933-jgxqmedium4.3

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

Impact

ChartsController::actionGetNewUsersData() at /actions/charts/get-new-users-data is missing a requirePermission('viewUsers') authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.

Source excerpt · OSV
Applies when

In installations with multiple editor roles, this allows a low-privilege control panel user to infer user group sizes and registration trends that would normally require the viewUsers permission to access.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

craftcms/cms Packagist
Affected rangeRecorded fix
From 4.0.0-RC1 before 4.18.1Ecosystem versions4.18.1
From 5.0.0-RC1 before 5.10.3Ecosystem versions5.10.3

Version evidence: OSV · GHSA-rvmm-v933-jgxq

View original version evidence (425 explicit versions)

Original source description

ChartsController::actionGetNewUsersData() at /actions/charts/get-new-users-data is missing a requirePermission('viewUsers') authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts for the entire site or for an arbitrary user group ID.

The viewUsers permission is consistently required throughout the control panel before exposing user-related data, but this action enforces only the base accessCp check inherited from the framework.

Each call returns the total count of users who joined the specified group in the requested period.

Impact

Any control panel user with only accessCp permission can obtain the total number of registered users and their registration date distribution across any time window.

In installations with multiple editor roles, this allows a low-privilege control panel user to infer user group sizes and registration trends that would normally require the viewUsers permission to access.

No user PII (name, email, password) is disclosed; only aggregate counts and timestamps are returned. Confidentiality impact is low. No integrity or availability impact.

References