Craft CMS versions 4.x before 4.17.8 and 5.x before 5.9.14 allow unauthenticated guest users to access the configuration‑sync updater. By visiting the updater index they can retrieve signed data and invoke state‑changing actions such as regenerate‑yaml and apply‑yaml‑changes. This results in unauthorized modification of the site’s configuration settings, potentially altering functionality, security‑related options or even exposed data. The weakness is a lack of an authentication check for these privileged operations (CWE‑306) and a failure to enforce role‑based permissions (CWE‑862).

The affected product is Craft CMS from the vendor Craft CMS. The vulnerability applies to all releases in the 4.x line starting at 4.0.0‑RC1 up to, but not including, 4.17.8, and to the 5.x line starting at 5.0.0‑RC1 up to, but not including, 5.9.14. Any installation of these versions that has the configuration sync feature enabled is susceptible.

The CVSS v3.1 base score is 6.9, indicating a moderate severity that could lead to configuration tampering. The EPSS score is reported as less than 1 %, suggesting that the likelihood of exploitation observed in the wild is currently low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, performed through the website’s publicly accessible HTTP/HTTPS interface, where an attacker can send crafted requests to the config‑sync endpoints. Exploitation requires no prior authentication, only knowledge of the endpoint URLs, making it straightforward for an unauthenticated user to trigger the permitted actions.