CVE-2026-33159: 
PHP vulnerability analysis and mitigation

CVE-2026-33159 is a missing authentication and authorization vulnerability in Craft CMS that allows unauthenticated users to execute restricted project configuration sync operations. Disclosed on March 24, 2026, it affects Craft CMS versions >= 4.0.0-RC1 through <= 4.17.7 and >= 5.0.0-RC1 through <= 5.9.13. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Craft CMS Advisory).

The root cause lies in ConfigSyncController extending BaseUpdaterController, where the base updater controller is anonymously accessible for control panel requests (CWE-306: Missing Authentication for Critical Function; CWE-862: Missing Authorization). The index action emits signed updater state data that can be captured by an unauthenticated guest and reused in subsequent requests to trigger sensitive actions including actionApplyYamlChanges, actionRegenerateYaml, applyExternalChanges, and regenerateExternalConfig. No special preconditions are required — the attack is network-accessible, requires no privileges, and involves no user interaction. The fix added $allowAnonymous = self::ALLOW_ANONYMOUS_NEVER and a beforeAction() method enforcing requireAdmin() in ConfigSyncController (Craft CMS Advisory, Fix Commit).

Successful exploitation allows unauthenticated remote attackers to trigger project configuration synchronization operations — specifically YAML regeneration and application of pending YAML config changes — without any credentials. This can result in unauthorized configuration state transitions, potential exposure of sensitive configuration data embedded in signed state responses, and degradation of service integrity if malicious or unintended config states are applied. While availability is not directly impacted, the integrity of the CMS configuration and potentially the confidentiality of configuration details are at risk (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.106% (0.001060), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory).

1. Reconnaissance: Identify internet-facing Craft CMS instances running versions 4.0.0-RC1 through 4.17.7 or 5.0.0-RC1 through 5.9.13 using tools like Shodan or Censys, or by inspecting HTTP response headers and page metadata.
2. Access the Config Sync index: As an unauthenticated guest, send an HTTP POST request to /admin/actions/config-sync/index to retrieve the updater state response.
3. Extract signed state data: Parse the JavaScript response body for the Craft.updater state object and extract the data field (signed updater state token).
4. Trigger restricted actions: Reuse the extracted data value in subsequent unauthenticated POST requests to sensitive endpoints such as:
   • POST /admin/actions/config-sync/regenerate-yaml with body data=<extracted_value>
   • POST /admin/actions/config-sync/apply-yaml-changes with body data=<extracted_value>
5. Observe impact: Confirm that the server responds with a completed state, indicating that YAML regeneration or config application has been executed without authentication, potentially altering the CMS project configuration (Craft CMS Advisory).

• Network: Unexpected unauthenticated POST requests to /admin/actions/config-sync/index, /admin/actions/config-sync/regenerate-yaml, or /admin/actions/config-sync/apply-yaml-changes from external or unknown IP addresses.
• Logs: Web server access logs showing POST requests to the above config-sync endpoints without a valid authenticated session cookie; repeated access from the same IP in short succession.
• File System: Unexpected modifications to YAML project config files (typically under config/project/) with timestamps not corresponding to known admin activity.
• Application: Craft CMS application logs indicating config sync operations (YAML regeneration or application) completed outside of scheduled deployment windows or without corresponding admin user activity.

Craft CMS has released patched versions addressing this vulnerability: 4.17.8 for the 4.x branch and 5.9.14 for the 5.x branch. Upgrading to these versions is the primary recommended remediation, as the fix enforces admin authentication on all ConfigSyncController actions. As an interim workaround, network-level controls (e.g., WAF rules or firewall policies) should be used to restrict access to /admin/actions/config-sync/* endpoints from untrusted sources. Administrators should also audit YAML project config files for unauthorized changes that may have occurred prior to patching (Release 4.17.8, Release 5.9.14, Fix Commit).

The vulnerability was reported by researcher GCXWLP and published by the Craft CMS maintainer (angrybrad) via GitHub Security Advisories on March 24, 2026. The fix was committed by Brandon Kelly (Craft CMS lead developer) and included in the same-day patch releases. Social media activity was limited, with brief mentions on Bluesky and automated vulnerability tracking platforms shortly after disclosure (Craft CMS Advisory).