CVE-2026-123490 · Runtime
NO FIX YET · SEE WHAT TO DO
Craft CMS versions from 5.8.17 before 5.11.2 let logged-in control panel users pass crafted criteria to getOwners(), which runs attacker-chosen static PHP callables. An attacker can use this to promote every account, including their own, to administrator.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running Craft CMS 5.8.17 up to but not including 5.11.2. The attacker needs a control panel login, so sites that restrict control panel accounts to trusted staff have a smaller exposure, but any account with control panel access can escalate.
Not affected if no-control-panel-users, version-outside-range
Who cares craft-cms, php, self-hosted
composer.lock or by running php craft version5.8.17 and 5.11.25.11.2 or laterCraft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.