[MEDIUM] Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

PKSA-x2qp-qkxh-fw67 CVE-2026-14793 GHSA-9p7c-v5x3-rfx8

Affected package: craftcms/cms

Affected version: >=5.0.0-RC1,<5.10.3|>=4.0.0-RC1,<4.18.1

Reported by:
GitHub