Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 is affected when its public GraphQL schema gives anonymous read access to a section or asset volume. Fixed in 4.18.9 and 5.11.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.18.9, 5.11.2
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 34/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Craft CMS, a content management system, has an SQL injection flaw in its GraphQL eager-loading that lets an attacker remotely, without logging in, read arbitrary database content, including password hashes and session tokens. The flaw is reached by supplying a crafted select argument to arguments on eager-loadable nodes that are not in the public GraphQL schema.
Read the original description
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized select argument to inject SQL expressions and read arbitrary database content, including password hashes and session tokens.
cve.now Index
- Exploitation0/40No signal
- Exposure25/25Default setups, CISA rates it automatable
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.8/10CVSS 8.8
- No patch0/5No signal
What would change the score
- Would score about 74 if added to CISA KEV
- Would score about 69 if CISA's SSVC rates exploitation active
What to do
Check every install: default setups are affected.
Upgrade to a fixed version: 4.18.9, 5.11.2.
Workaround: Grant the public schema user-group read access, which makes uploader and author published fields so the injected select argument is rejected.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- craftcms cms
From 4.0.0 · fixed in 4.18.9
- craftcms cms
From 5.0.0 · fixed in 5.11.2
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123491
Is CVE-2026-123491 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An unauthenticated request can read arbitrary data from the Craft database, including user email addresses, password hashes, and session and verification tokens. This works regardless of the GraphQL schema scope. The cause is that arguments on eager-loadable GraphQL nodes that are absent from the public schema are copied into query criteria without cleansing.Source: github.com, vulncheck.com
Which versions are affected by CVE-2026-123491?
cms: from 4.0.0 before 4.18.9. cms: from 5.0.0 before 5.11.2.Source: cve.now feed data
Am I affected, and how do I check?
Affected versions are Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2. The setup also requires the public GraphQL schema to be enabled with anonymous read access to at least one section or asset volume, but not to user groups, and at least one entry with an author or at least one asset with a populated uploaderId. The installed version can be checked with the Craft admin dashboard or with composer show craftcms/cms.Source: github.com, vulncheck.com
How do I fix CVE-2026-123491?
Upgrade to Craft CMS 4.18.9 or 5.11.2, matching the major version in use. Both versions are listed as fixed.Source: github.com, vulncheck.com