{"id":"CVE-2026-123489","kind":"vulnerability","aliases":["CVE-2026-123489"],"related":[],"title":"Craft CMS: blind SQL injection via sandboxed getNext and getPrev methods","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.","summary":"Craft CMS passes attacker-supplied criteria arrays into element query configuration, letting a template build SQL that reveals database contents one yes-or-no answer at a time. An authenticated control panel user can read data the Craft database account can see.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","package","php","self-hosted"],"not_affected_if":["managed-hosting-patched","no-control-panel-users"],"how_to_check":"- Check the installed Craft version with `composer show craftcms/cms` and compare it to the fixed ranges below.\n- Confirm whether untrusted users have control panel access.","fix":"- Craft CMS 4.x: `4.18.9` or later\n- Craft CMS 5.x: `5.11.2` or later","status":"open","published_at":"2026-11-06T15:17:18+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:19+00:00","updated_at":"2026-11-06T15:44:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T15:44:19Z","model":"claude-haiku-5-5","output":{"fix":"- Craft CMS 4.x: `4.18.9` or later\n- Craft CMS 5.x: `5.11.2` or later","reach":"network","title":"Craft CMS: blind SQL injection via sandboxed getNext and getPrev methods","impact":"medium","summary":"Craft CMS passes attacker-supplied criteria arrays into element query configuration, letting a template build SQL that reveals database contents one yes-or-no answer at a time. An authenticated control panel user can read data the Craft database account can see.","audience":"businesses","category":"package","nicknames":[],"who_cares":["craft-cms","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Database contents read through blind SQL inference by a control panel user","analyst_note":"","how_to_check":"- Check the installed Craft version with `composer show craftcms/cms` and compare it to the fixed ranges below.\n- Confirm whether untrusted users have control panel access.","plain_action":"","needs_analyst":false,"not_affected_if":["no-control-panel-users","managed-hosting-patched"],"who_is_affected":"Sites running Craft CMS 4.0.0 to before 4.18.9 or Craft CMS 5.0.0 to before 5.11.2 where users can log into the control panel. Exposure depends on who has control panel accounts; sites with no control panel users outside the trusted team are lower risk. Public-facing sites with no control panel login can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":4353,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123489':14A,17A '-2026':13A,16A '4.0.0':72C '4.18.9':74C '5.0.0':76C '5.11.2':78C 'account':67B,137C 'answer':52B 'arbitrari':95C 'array':33B,97C 'attack':30B 'attacker-suppli':29B 'authent':57B,112C 'bear':105C 'blind':3A,81C 'build':41B 'cms':2A,20B,27B,71C 'condit':130C 'configur':37B,100C 'contain':79C 'content':46B 'control':58B,113C 'craft':1A,19B,26B,65B,70C,99C,119C,135C 'craft-cm':18B 'criteria':32B,96C 'cve':12A,15A 'data':63B 'databas':45B,66B,136C 'element':35B 'elementid':120C 'expos':89C 'getnext':8A,90C 'getprev':10A,92C 'host':25B 'inject':5A,83C 'let':38B 'method':11A,93C 'obtain':128C 'one':47B 'oracl':132C 'orderbi':109C 'packag':21B 'panel':59B,114C 'pass':28B,94C 'php':22B 'properti':106C 'queri':36B 'read':62B 'remov':102C 'render':122C 'reveal':44B 'sandbox':7A,88C,125C 'sandbox-expos':87C 'see':69B 'self':24B 'self-host':23B 'sql':4A,42B,82C,104C,131C 'sql-bear':103C 'suppli':31B,117C 'templat':40B,126C 'time':55B 'user':60B,115C 'valu':121C 'via':6A 'vulner':84C 'without':101C 'yes':49B 'yes-or-no':48B","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS 4.0.0 to before 4.18.9 or Craft CMS 5.0.0 to before 5.11.2 where users can log into the control panel. Exposure depends on who has control panel accounts; sites with no control panel users outside the trusted team are lower risk. Public-facing sites with no control panel login can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["craftcms","high","package","php","selfhosted"],"campaign_type":null,"search_a":"'-123489':14A,17A '-2026':13A,16A 'blind':3A 'cms':2A 'craft':1A 'cve':12A,15A 'getnext':8A 'getprev':10A 'inject':5A 'method':11A 'sandbox':7A 'sql':4A 'via':6A","search_b":"'account':67B 'answer':52B 'array':33B 'attack':30B 'attacker-suppli':29B 'authent':57B 'build':41B 'cms':20B,27B 'configur':37B 'content':46B 'control':58B 'craft':19B,26B,65B 'craft-cm':18B 'criteria':32B 'data':63B 'databas':45B,66B 'element':35B 'host':25B 'let':38B 'one':47B 'packag':21B 'panel':59B 'pass':28B 'php':22B 'queri':36B 'read':62B 'reveal':44B 'see':69B 'self':24B 'self-host':23B 'sql':42B 'suppli':31B 'templat':40B 'time':55B 'user':60B 'yes':49B 'yes-or-no':48B","search_c":"'4.0.0':72C '4.18.9':74C '5.0.0':76C '5.11.2':78C 'account':137C 'arbitrari':95C 'array':97C 'authent':112C 'bear':105C 'blind':81C 'cms':71C 'condit':130C 'configur':100C 'contain':79C 'control':113C 'craft':70C,99C,119C,135C 'criteria':96C 'databas':136C 'elementid':120C 'expos':89C 'getnext':90C 'getprev':92C 'inject':83C 'method':93C 'obtain':128C 'oracl':132C 'orderbi':109C 'panel':114C 'pass':94C 'properti':106C 'remov':102C 'render':122C 'sandbox':88C,125C 'sandbox-expos':87C 'sql':82C,104C,131C 'sql-bear':103C 'suppli':117C 'templat':126C 'user':115C 'valu':121C 'vulner':84C 'without':101C","first_public_at":"2026-10-22T22:51:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123489","severity":null,"published_at":"2026-11-06T15:17:18+00:00","modified_at":"2026-11-06T15:17:18+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87558,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-f6gf-r952-rxg6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T22:51:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87559,"url":"https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-blind-sql-injection-via-getnext-getprev-criteria","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}