Craft CMS: Privilege escalation via getOwners() (CVE-2026-123490)

Craft CMS versions 5.8.17 through 5.11.1 are vulnerable to a privilege escalation flaw (CVE-2026-123490) within the getOwners() method. The vulnerability arises because the method applies caller criteria without proper sanitization of query configuration. An authenticated user with control panel access can supply crafted criteria to trigger arbitrary static PHP callables, leading to unauthorized account privilege elevation.

Impact

Successful exploitation allows an authenticated user with control panel access to elevate their own or any other user's account to administrative privileges.

Recommendation

• Upgrade Craft CMS to version 5.11.2 or later immediately to include the required sanitization patches for query criteria.
• Audit control panel user accounts for suspicious administrative role assignments created or modified recently.
• Monitor logs for unusual requests directed at administrative endpoints or criteria-based search/query parameters within the Craft CMS control panel.