Craft CMS: SQL injection in GraphQL eager-loading (CVE-2026-123491)

Craft CMS contains an SQL injection vulnerability in the GraphQL eager-loading component. Unauthenticated attackers can supply a crafted select argument within eager-loadable nodes, which are then improperly processed by the EagerLoadPlan criteria. This flaw allows unauthorized read access to database records, including password hashes and session tokens.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass application-level access controls and extract sensitive database contents. The vulnerability affects the confidentiality of the entire database, including authentication credentials and active session identifiers.

Recommendation

• Update Craft CMS installations to version 4.18.9 or 5.11.2 immediately to address the insecure handling of GraphQL arguments.
• Review database access logs for unusual queries originating from GraphQL API endpoints.
• Reset application-level credentials and invalidate active session tokens if indicators of database enumeration are identified.