Craft CMS (5.8.17 - 5.11.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/craft-cms-5.8.17---5.11.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 17:23:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCraft CMS: Privilege escalation via getOwners() (CVE-2026-123490)https://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation/Fri, 06 Nov 2026 17:23:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-craft-cms-privilege-escalation/Craft CMS versions 5.8.17 through 5.11.1 contain a privilege escalation vulnerability in the getOwners() method that allows authenticated users to promote accounts to administrator status.Craft CMS versions 5.8.17 through 5.11.1 are vulnerable to a privilege escalation flaw (CVE-2026-123490) within the getOwners() method. The vulnerability arises because the method applies caller criteria without proper sanitization of query configuration. An authenticated user with control panel access can supply crafted criteria to trigger arbitrary static PHP callables, leading to unauthorized account privilege elevation.

Impact

Successful exploitation allows an authenticated user with control panel access to elevate their own or any other user's account to administrative privileges.

Recommendation

  • Upgrade Craft CMS to version 5.11.2 or later immediately to include the required sanitization patches for query criteria.
  • Audit control panel user accounts for suspicious administrative role assignments created or modified recently.
  • Monitor logs for unusual requests directed at administrative endpoints or criteria-based search/query parameters within the Craft CMS control panel.
]]>highadvisory