A vulnerability in Craft CMS up to version 4.18.0.1 allows non-admin control panel users to reorder Global Sets without proper authorization. This authorization bypass affects the actionReorderSets function in the GlobalsController.php file. The issue can be exploited remotely and is addressed by upgrading to version 4.18.1.