{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/craft-cms-4.0.0-4.18.9-5.0.0-5.11.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-123491"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Craft CMS (4.0.0-4.18.9, 5.0.0-5.11.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Craft CMS"],"content_html":"\u003cp\u003eCraft CMS contains an SQL injection vulnerability in the GraphQL eager-loading component. Unauthenticated attackers can supply a crafted select argument within eager-loadable nodes, which are then improperly processed by the EagerLoadPlan criteria. This flaw allows unauthorized read access to database records, including password hashes and session tokens.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to bypass application-level access controls and extract sensitive database contents. The vulnerability affects the confidentiality of the entire database, including authentication credentials and active session identifiers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Craft CMS installations to version 4.18.9 or 5.11.2 immediately to address the insecure handling of GraphQL arguments.\u003c/li\u003e\n\u003cli\u003eReview database access logs for unusual queries originating from GraphQL API endpoints.\u003c/li\u003e\n\u003cli\u003eReset application-level credentials and invalidate active session tokens if indicators of database enumeration are identified.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:24:00Z","date_published":"2026-11-06T17:24:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli-9b34e80d/","summary":"Craft CMS versions 4.x before 4.18.9 and 5.x before 5.11.2 are vulnerable to SQL injection via the GraphQL eager-loading mechanism, allowing unauthenticated attackers to disclose arbitrary database content.","title":"Craft CMS: SQL injection in GraphQL eager-loading (CVE-2026-123491)","url":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli-9b34e80d/"}],"language":"en","title":"CraftedSignal Threat Feed - Craft CMS (4.0.0-4.18.9, 5.0.0-5.11.2)","version":"https://jsonfeed.org/version/1.1"}