{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491) · updates",
  "home_page_url": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026",
  "feed_url": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026/feed.json",
  "description": "Craft CMS published four security advisories fixed in 4.18.9 and 5.11.2 (and 5.11.2-only for one). CVE-2026-123488 is an unauthenticated SQL injection in the element search endpoint (CVSS 9.8) that lets remote attackers read/write the database and escalate to admin. CVE-2026-123491 is unauthenticated GraphQL eager-load SQLi (8.2). CVE-2026-123489 is control-panel blind SQLi via getNext/getPrev (7.1). CVE-2026-123490 is authenticated privilege escalation via getOwners() sandbox criteria (8.8, Craft 5.8.17–before 5.11.2). Upgrade to 4.18.9 or 5.11.2.",
  "language": "en",
  "_pwn": {
    "slug": "craft-cms-sqli-priv-esc-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026#2026-11-06-ff3afeb0",
      "url": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026#2026-11-06-ff3afeb0",
      "title": "Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491): Craft CMS publishes GHSA-qcvp-ggx3-97r6 (unauthenticated element-search SQLi), GHSA-mjj9-pjh4-r48g (GraphQL eager-load SQLi), GHSA-f6gf-r952-rxg6 (CP blind SQLi), and GHSA-r56r-f696-c8w9 (getOwners privilege escalation), fixed in 4.18.9 / 5.11.2.",
      "content_text": "Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491): Craft CMS publishes GHSA-qcvp-ggx3-97r6 (unauthenticated element-search SQLi), GHSA-mjj9-pjh4-r48g (GraphQL eager-load SQLi), GHSA-f6gf-r952-rxg6 (CP blind SQLi), and GHSA-r56r-f696-c8w9 (getOwners privilege escalation), fixed in 4.18.9 / 5.11.2.\n\nSource: https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026#2026-11-06-1a29822d",
      "url": "https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026#2026-11-06-1a29822d",
      "title": "Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491): NVD publishes CVE-2026-123488 (CVSS 9.8) describing unauthenticated SQLi via the attribute parameter on the element search endpoint.",
      "content_text": "Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491): NVD publishes CVE-2026-123488 (CVSS 9.8) describing unauthenticated SQLi via the attribute parameter on the element search endpoint.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-123488",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123488",
      "tags": [
        "critical"
      ]
    }
  ]
}