GraphQL

Security incidents tagged GraphQL. Newest first.

1 GraphQL incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Patched
Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491)
Craft CMS published four security advisories fixed in 4.18.9 and 5.11.2 (and 5.11.2-only for one). CVE-2026-123488 is an unauthenticated SQL injection in the element search endpoint (CVSS 9.8) that lets remote attackers read/write the database and escalate to admin. CVE-2026-123491 is unauthenticated GraphQL eager-load SQLi (8.2). CVE-2026-123489 is control-panel blind SQLi via getNext/getPrev (7.1). CVE-2026-123490 is authenticated privilege escalation via getOwners() sandbox criteria (8.8, Craft 5.8.17–before 5.11.2). Upgrade to 4.18.9 or 5.11.2.
Craft CMSSince Nov 6, 2026updated Nov 6, 2026, 16:19 UTC