A flaw in Craft CMS allows manipulation of the userGroupId parameter in the ChartsController actionGetNewUsersData endpoint, causing the system to skip required authorization checks. This lets an attacker retrieve data about newly registered users from any group that the requestor ordinarily has no access to, effectively exposing sensitive account creation information to unauthorized parties. The flaw corresponds to CWE-266 (Permissions, Privileges, or Access Controls) and CWE-285 (Improper Authorization).

Craft CMS versions up to and including 4.18.0.1 are affected. The vulnerability exists in the Charts component of the CMS, specifically src/controllers/ChartsController.php. Any site running those versions of the CMS is potentially exploitable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw remotely by sending a crafted request to the endpoint; the data does not specify whether privilege escalation is necessary, so any assumption about its absence would be speculative.