Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491)

Craft CMS

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Craft CMS published four security advisories fixed in 4.18.9 and 5.11.2 (and 5.11.2-only for one). CVE-2026-123488 is an unauthenticated SQL injection in the element search endpoint (CVSS 9.8) that lets remote attackers read/write the database and escalate to admin. CVE-2026-123491 is unauthenticated GraphQL eager-load SQLi (8.2). CVE-2026-123489 is control-panel blind SQLi via getNext/getPrev (7.1). CVE-2026-123490 is authenticated privilege escalation via getOwners() sandbox criteria (8.8, Craft 5.8.17–before 5.11.2). Upgrade to 4.18.9 or 5.11.2.

Why this severity: CVE-2026-123488 CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); unauthenticated DB read/write and admin takeover; three additional high SQLi/privesc issues in the same release

Started
Nov 6, 2026
CVEs
CVE-2026-123488CVE-2026-123489CVE-2026-123490CVE-2026-123491

Follow this incident

Discuss on X ↗

Affected

  • Craft CMS 4.0.0 before 4.18.9 (CVE-2026-123488, CVE-2026-123489, CVE-2026-123491)
  • Craft CMS 5.0.0 before 5.11.2 (CVE-2026-123488, CVE-2026-123489, CVE-2026-123491)
  • Craft CMS 5.8.17 before 5.11.2 (CVE-2026-123490)

Fixed in

  • 4.18.9
  • 5.11.2

Timeline2

  1. Craft CMS publishes GHSA-qcvp-ggx3-97r6 (unauthenticated element-search SQLi), GHSA-mjj9-pjh4-r48g (GraphQL eager-load SQLi), GHSA-f6gf-r952-rxg6 (CP blind SQLi), and GHSA-r56r-f696-c8w9 (getOwners privilege escalation), fixed in 4.18.9 / 5.11.2.

  2. NVD publishes CVE-2026-123488 (CVSS 9.8) describing unauthenticated SQLi via the attribute parameter on the element search endpoint.

Advisories5

Notes & caveats

Distinct from older tracked Craft CMS KEV entries (CVE-2025-23209, CVE-2024-56145). Do not cite cve.now.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo