{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/craft-cms-5.8.17---5.11.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-123490"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Craft CMS (5.8.17 - 5.11.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Craft CMS"],"content_html":"\u003cp\u003eCraft CMS versions 5.8.17 through 5.11.1 are vulnerable to a privilege escalation flaw (CVE-2026-123490) within the getOwners() method. The vulnerability arises because the method applies caller criteria without proper sanitization of query configuration. An authenticated user with control panel access can supply crafted criteria to trigger arbitrary static PHP callables, leading to unauthorized account privilege elevation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user with control panel access to elevate their own or any other user's account to administrative privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Craft CMS to version 5.11.2 or later immediately to include the required sanitization patches for query criteria.\u003c/li\u003e\n\u003cli\u003eAudit control panel user accounts for suspicious administrative role assignments created or modified recently.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual requests directed at administrative endpoints or criteria-based search/query parameters within the Craft CMS control panel.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:23:55Z","date_published":"2026-11-06T17:23:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation/","summary":"Craft CMS versions 5.8.17 through 5.11.1 contain a privilege escalation vulnerability in the getOwners() method that allows authenticated users to promote accounts to administrator status.","title":"Craft CMS: Privilege escalation via getOwners() (CVE-2026-123490)","url":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Craft CMS (5.8.17 - 5.11.1)","version":"https://jsonfeed.org/version/1.1"}