Craft CMS (4.0.0-4.18.9, 5.0.0-5.11.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/craft-cms-4.0.0-4.18.9-5.0.0-5.11.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 17:24:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCraft CMS: SQL injection in GraphQL eager-loading (CVE-2026-123491)https://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli-9b34e80d/Fri, 06 Nov 2026 17:24:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli-9b34e80d/Craft CMS versions 4.x before 4.18.9 and 5.x before 5.11.2 are vulnerable to SQL injection via the GraphQL eager-loading mechanism, allowing unauthenticated attackers to disclose arbitrary database content.Craft CMS contains an SQL injection vulnerability in the GraphQL eager-loading component. Unauthenticated attackers can supply a crafted select argument within eager-loadable nodes, which are then improperly processed by the EagerLoadPlan criteria. This flaw allows unauthorized read access to database records, including password hashes and session tokens.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass application-level access controls and extract sensitive database contents. The vulnerability affects the confidentiality of the entire database, including authentication credentials and active session identifiers.

Recommendation

  • Update Craft CMS installations to version 4.18.9 or 5.11.2 immediately to address the insecure handling of GraphQL arguments.
  • Review database access logs for unusual queries originating from GraphQL API endpoints.
  • Reset application-level credentials and invalidate active session tokens if indicators of database enumeration are identified.
]]>highadvisory