Craft CMS versions 5.0.0 through 5.10.13 contain a missing authorization flaw in the AppController::actionSwitchToLicensedEdition() endpoint. The flaw allows any authenticated user, even those with low‑privileged front‑end roles, to invoke the route and change the licensed edition. The change persists in the project configuration file and cannot be reversed from the control panel, effectively downgrading the site to a lower edition without administrator intervention. This unauthorized downgrade can lead to loss of features, restrictions in functionality, and possible security exposure due to the lower edition's capabilities.

Craft CMS website installations from version 5.0.0 up to and including 5.10.13. The vulnerability is present regardless of specific deployment style, as long as an authenticated user can reach the application route. No particular sub‑components or modules are enumerated beyond the core AppController.

The CVSS score of 6.0 signifies medium severity, and no EPSS value is presented. The vulnerability is not listed in CISA’s KEV catalog. Attackers require only authenticated access to the application, which is typically available to normal front‑end users. Because the flaw is a missing authorization check, the intent is to elevate privileges to perform a configuration change. The exploit is straightforward once logged in and can be carried out via an HTTP request to the action route using the user's existing session. The risk is medium to high for sites that rely on the higher edition for critical functionality, as unauthorized downgrading occurs without any administrative action.