{"id":"CVE-2026-123491","kind":"vulnerability","aliases":["CVE-2026-123491"],"related":[],"title":"Craft CMS: GraphQL eager-loading SQL injection exposes database contents","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized select argument to inject SQL expressions and read arbitrary database content, including password hashes and session tokens.","summary":"Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 let GraphQL eager-loading copy unsanitized arguments into database queries. An unauthenticated attacker can inject SQL to read arbitrary database content, including password hashes and session tokens.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","graphql","package","php","self-hosted"],"not_affected_if":["auth-required","graphql-disabled"],"how_to_check":"- Check the installed Craft CMS version in `composer.lock` or by running `composer show craftcms/cms`.\n- Confirm whether the site exposes a public GraphQL endpoint.","fix":"- Craft CMS 4.x: upgrade to `4.18.9` or later.\n- Craft CMS 5.x: upgrade to `5.11.2` or later.","status":"open","published_at":"2026-11-06T15:17:18+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:02+00:00","updated_at":"2026-11-06T15:44:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T15:44:02Z","model":"claude-haiku-5-5","output":{"fix":"- Craft CMS 4.x: upgrade to `4.18.9` or later.\n- Craft CMS 5.x: upgrade to `5.11.2` or later.","reach":"internet","title":"Craft CMS: GraphQL eager-loading SQL injection exposes database contents","impact":"high","summary":"Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 let GraphQL eager-loading copy unsanitized arguments into database queries. An unauthenticated attacker can inject SQL to read arbitrary database content, including password hashes and session tokens.","audience":"businesses","category":"package","nicknames":[],"who_cares":["craft-cms","php","self-hosted","graphql"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads password hashes and session tokens from the database","analyst_note":"Confirm whether the public GraphQL endpoint is required for exploitation, using the vendor advisory at github.com and the VulnCheck advisory at www.vulncheck.com.","how_to_check":"- Check the installed Craft CMS version in `composer.lock` or by running `composer show craftcms/cms`.\n- Confirm whether the site exposes a public GraphQL endpoint.","plain_action":"","needs_analyst":true,"not_affected_if":["graphql-disabled","auth-required"],"who_is_affected":"Sites running Craft CMS 4.0.0 to 4.18.8 or 5.0.0 to 5.11.1 with a publicly reachable GraphQL endpoint are exposed, because the flaw is in eager-loading arguments that the public schema does not list. Unauthenticated requests can reach it. Sites with GraphQL disabled or behind authentication are less exposed, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4339,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123491':14A,17A '-2026':13A,16A '4.0.0':30B,67C '4.18.9':32B,69C '5.0.0':34B,71C '5.11.2':36B,73C 'absent':90C 'arbitrari':56B,116C 'argument':44B,84C,109C 'attack':50B,103C 'cleans':101C 'cms':2A,20B,28B,66C 'contain':74C 'content':11A,58B,118C 'copi':42B,96C 'craft':1A,19B,27B,65C 'craft-cm':18B 'criteria':99C 'cve':12A,15A 'databas':10A,46B,57B,117C 'eager':5A,40B,82C,87C 'eager-load':4A,39B,81C,86C 'eagerloadplan':98C 'expos':9A 'express':113C 'graphql':3A,21B,38B,80C 'hash':61B,121C 'host':26B 'includ':59B,119C 'inject':8A,52B,77C,111C 'let':37B 'load':6A,41B,83C 'loadabl':88C 'node':89C 'packag':22B 'parenthes':107C 'password':60B,120C 'php':23B 'public':93C 'queri':47B 'read':55B,115C 'schema':94C 'select':108C 'self':25B 'self-host':24B 'session':63B,123C 'sql':7A,53B,76C,112C 'suppli':105C 'token':64B,124C 'unauthent':49B,102C 'unsanit':43B 'version':29B 'vulner':78C 'without':100C","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS 4.0.0 to 4.18.8 or 5.0.0 to 5.11.1 with a publicly reachable GraphQL endpoint are exposed, because the flaw is in eager-loading arguments that the public schema does not list. Unauthenticated requests can reach it. Sites with GraphQL disabled or behind authentication are less exposed, though the sources do not state this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["craftcms","graphql","high","package","php","selfhosted"],"campaign_type":null,"search_a":"'-123491':14A,17A '-2026':13A,16A 'cms':2A 'content':11A 'craft':1A 'cve':12A,15A 'databas':10A 'eager':5A 'eager-load':4A 'expos':9A 'graphql':3A 'inject':8A 'load':6A 'sql':7A","search_b":"'4.0.0':30B '4.18.9':32B '5.0.0':34B '5.11.2':36B 'arbitrari':56B 'argument':44B 'attack':50B 'cms':20B,28B 'content':58B 'copi':42B 'craft':19B,27B 'craft-cm':18B 'databas':46B,57B 'eager':40B 'eager-load':39B 'graphql':21B,38B 'hash':61B 'host':26B 'includ':59B 'inject':52B 'let':37B 'load':41B 'packag':22B 'password':60B 'php':23B 'queri':47B 'read':55B 'self':25B 'self-host':24B 'session':63B 'sql':53B 'token':64B 'unauthent':49B 'unsanit':43B 'version':29B","search_c":"'4.0.0':67C '4.18.9':69C '5.0.0':71C '5.11.2':73C 'absent':90C 'arbitrari':116C 'argument':84C,109C 'attack':103C 'cleans':101C 'cms':66C 'contain':74C 'content':118C 'copi':96C 'craft':65C 'criteria':99C 'databas':117C 'eager':82C,87C 'eager-load':81C,86C 'eagerloadplan':98C 'express':113C 'graphql':80C 'hash':121C 'includ':119C 'inject':77C,111C 'load':83C 'loadabl':88C 'node':89C 'parenthes':107C 'password':120C 'public':93C 'read':115C 'schema':94C 'select':108C 'session':123C 'sql':76C,112C 'suppli':105C 'token':124C 'unauthent':102C 'vulner':78C 'without':100C","first_public_at":"2026-10-22T22:48:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123491","severity":null,"published_at":"2026-11-06T15:17:18+00:00","modified_at":"2026-11-06T15:17:18+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87562,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-mjj9-pjh4-r48g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T22:48:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87563,"url":"https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-unauthenticated-sql-injection-via-graphql-eager-load-select","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}