# Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491) · pwn.watch

> Craft CMS published four security advisories fixed in 4.18.9 and 5.11.2 (and 5.11.2-only for one). CVE-2026-123488 is an unauthenticated SQL injection in the element search endpoint (CVSS 9.8) that lets remote attackers read/write the database and escalate to admin. CVE-2026-123491 is unauthenticated GraphQL eager-load SQLi (8.2). CVE-2026-123489 is control-panel blind SQLi via getNext/getPrev (7.1). CVE-2026-123490 is authenticated privilege escalation via getOwners() sandbox criteria (8.8, Craft 5.8.17–before 5.11.2). Upgrade to 4.18.9 or 5.11.2.

Page: https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026 · generated 2026-11-06T18:16:06.472Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Craft CMS
- Started: 2026-11-06
- CVEs: CVE-2026-123488, CVE-2026-123489, CVE-2026-123490, CVE-2026-123491
- Affected: Craft CMS 4.0.0 before 4.18.9 (CVE-2026-123488, CVE-2026-123489, CVE-2026-123491); Craft CMS 5.0.0 before 5.11.2 (CVE-2026-123488, CVE-2026-123489, CVE-2026-123491); Craft CMS 5.8.17 before 5.11.2 (CVE-2026-123490)
- Fixed in: 4.18.9; 5.11.2

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026.json
- This file: https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-06: Craft CMS publishes GHSA-qcvp-ggx3-97r6 (unauthenticated element-search SQLi), GHSA-mjj9-pjh4-r48g (GraphQL eager-load SQLi), GHSA-f6gf-r952-rxg6 (CP blind SQLi), and GHSA-r56r-f696-c8w9 (getOwners privilege escalation), fixed in 4.18.9 / 5.11.2. (https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6)
- 2026-11-06: NVD publishes CVE-2026-123488 (CVSS 9.8) describing unauthenticated SQLi via the attribute parameter on the element search endpoint. (https://nvd.nist.gov/vuln/detail/CVE-2026-123488)

## Fix brief
# Security brief: Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491)

Source: https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026 · status: live · severity: critical · updated Nov 6, 2026, 17:34 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Craft CMS published four security advisories fixed in 4.18.9 and 5.11.2 (and 5.11.2-only for one). CVE-2026-123488 is an unauthenticated SQL injection in the element search endpoint (CVSS 9.8) that lets remote attackers read/write the database and escalate to admin. CVE-2026-123491 is unauthenticated GraphQL eager-load SQLi (8.2). CVE-2026-123489 is control-panel blind SQLi via getNext/getPrev (7.1). CVE-2026-123490 is authenticated privilege escalation via getOwners() sandbox criteria (8.8, Craft 5.8.17–before 5.11.2). Upgrade to 4.18.9 or 5.11.2.

Severity detail: CVE-2026-123488 CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); unauthenticated DB read/write and admin takeover; three additional high SQLi/privesc issues in the same release

- Product: Craft CMS
- CVE / advisory ids: CVE-2026-123488, CVE-2026-123489, CVE-2026-123490, CVE-2026-123491

## Affected versions
- Craft CMS 4.0.0 before 4.18.9 (CVE-2026-123488, CVE-2026-123489, CVE-2026-123491)
- Craft CMS 5.0.0 before 5.11.2 (CVE-2026-123488, CVE-2026-123489, CVE-2026-123491)
- Craft CMS 5.8.17 before 5.11.2 (CVE-2026-123490)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 4.18.9
- 5.11.2

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 6, 2026: Craft CMS publishes GHSA-qcvp-ggx3-97r6 (unauthenticated element-search SQLi), GHSA-mjj9-pjh4-r48g (GraphQL eager-load SQLi), GHSA-f6gf-r952-rxg6 (CP blind SQLi), and GHSA-r56r-f696-c8w9 (getOwners privilege escalation), fixed in 4.18.9 / 5.11.2.
- Nov 6, 2026: NVD publishes CVE-2026-123488 (CVSS 9.8) describing unauthenticated SQLi via the attribute parameter on the element search endpoint.

## Advisories
- [SQL injection leading to privilege escalation (GHSA-qcvp-ggx3-97r6)](https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6) (Craft CMS)
- [Unauthenticated SQL injection via GraphQL eager-load select (GHSA-mjj9-pjh4-r48g)](https://github.com/craftcms/cms/security/advisories/GHSA-mjj9-pjh4-r48g) (Craft CMS)
- [Control panel blind SQLi via getNext/getPrev (GHSA-f6gf-r952-rxg6)](https://github.com/craftcms/cms/security/advisories/GHSA-f6gf-r952-rxg6) (Craft CMS)
- [Administrator privilege escalation via getOwners criteria (GHSA-r56r-f696-c8w9)](https://github.com/craftcms/cms/security/advisories/GHSA-r56r-f696-c8w9) (Craft CMS)
- [NVD: CVE-2026-123488](https://nvd.nist.gov/vuln/detail/CVE-2026-123488) (NVD)

## Caveats
Distinct from older tracked Craft CMS KEV entries (CVE-2025-23209, CVE-2024-56145). Do not cite cve.now.

---
Machine-readable: https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.