PT-2026-138061

CVE-2026-123491

Published

2026-11-06

Updated

2026-11-06

Description by

CVSS 4.0

8.8

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.8 Craft CMS versions 5.0.0 through 5.11.1

Description An SQL injection issue exists in GraphQL eager-loading, where arguments on eager-loadable nodes that are absent from the public schema are copied into EagerLoadPlan criteria without proper cleansing. Unauthenticated attackers can provide a parenthesized select argument to inject SQL expressions, allowing them to read arbitrary database content, such as session tokens and password hashes.

Recommendations Update Craft CMS to version 4.18.9 or later. Update Craft CMS to version 5.11.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Crypto-Cat

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers