THREAT OPS › Threat News › [GHSA] GHSA-rvmm-v933-jgxq (medium) — Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
[GHSA] GHSA-rvmm-v933-jgxq (medium) — Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
GHSA-rvmm-v933-jgxq Severity: medium CVE: None
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
`ChartsController::actionGetNewUsersData()` at `/actions/charts/get-new-users-data` is missing a `requirePermission('viewUsers')` authorization check. Any authenticated control panel user, regardless of permissions beyond `accessCp`, can P
MITRE ATT&CK techniques
- Control PanelT1218.002
Original source: https://github.com/advisories/GHSA-rvmm-v933-jgxq