CVE-2026-123491 · Package
NO FIX YET · SEE WHAT TO DO
Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 let GraphQL eager-loading copy unsanitized arguments into database queries. An unauthenticated attacker can inject SQL to read arbitrary database content, including password hashes and session tokens.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running Craft CMS 4.0.0 to 4.18.8 or 5.0.0 to 5.11.1 with a publicly reachable GraphQL endpoint are exposed, because the flaw is in eager-loading arguments that the public schema does not list. Unauthenticated requests can reach it. Sites with GraphQL disabled or behind authentication are less exposed, though the sources do not state this explicitly.
Not affected if auth-required, graphql-disabled
Who cares craft-cms, graphql, php, self-hosted
composer.lock or by running composer show craftcms/cms.4.18.9 or later.5.11.2 or later.Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized select argument to inject SQL expressions and read arbitrary database content, including password hashes and session tokens.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.