CVE-2026-14793: Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

The reorder-sets action in Craft CMS’s GlobalsController is missing the requireAdmin() check that the adjacent save-set and delete-set actions both enforce. Any authenticated control panel user can POST to /actions/globals/reorder-sets and permanently reorder all global sets in the project config, regardless of whether they have admin access. The reordering is written through to the project config and persists across requests.