Craft CMS: Authorization bypass via GraphQL API (CVE-2026-124427)
Craft CMS versions 5.0.0 through 5.11.1 contain an authorization bypass vulnerability allowing unauthenticated GraphQL clients to enumerate and extract out-of-scope content.
CVE search metadata
CVE search record: CVE-2026-124427. Severity: critical. CVSS: 9.8. KEV: no. Product: Craft CMS (5.0.0 through 5.11.1). Brief: Craft CMS: Authorization bypass via GraphQL API (CVE-2026-124427). Brief link: https://feed.craftedsignal.io/briefs/2026-11-craft-cms-auth-bypass/
Triage facts
Revision 2- Applicability
- Craft CMS (5.0.0 through 5.11.1)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 8, 16:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
Craft CMS versions 5.0.0 before 5.11.2 are affected by an authorization bypass vulnerability in the GraphQL API. The flaw allows unauthenticated attackers to access entries that should be withheld by traversing the prev/next navigation fields. By chaining these queries, attackers can enumerate and extract data from private or out-of-scope sections, including titles, slugs, and custom field content.
Impact
Unauthorized exposure of sensitive data stored in Craft CMS sections. Potential for full information disclosure of private entries.
Recommendation
Upgrade Craft CMS to version 5.11.2 or later immediately to resolve the authorization logic flaw.
Immediate actions
Upgrade Craft CMS to 5.11.2 or later
Threat Hunt
Identify anomalous GraphQL activity or high-volume traversal via prev/next queries
Data: Web server access logs, GraphQL API audit logs
Mitigations
Upgrade affected Craft CMS installations to 5.11.2
CVE-2026-124427