CVE-2026-124427 · Package
NO FIX YET · SEE WHAT TO DO
Craft CMS versions 5.0.0 through 5.11.1 fail to enforce section permissions on the GraphQL prev and next entry fields. An anonymous client can walk from one visible entry to others and read titles, slugs and custom field content from sections that are meant to be withheld.
first public Oct 23, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running Craft CMS 5.x before 5.11.2 that expose GraphQL to anonymous visitors and have sections whose entries are meant to be private. Sites that do not use GraphQL, or that require login for GraphQL, are less exposed. unknown whether managed hosting changes the risk.
Not affected if auth-required, no-graphql, version-5.11.2-or-later
Who cares craft-cms, graphql, php, self-hosted
Unknown from the sources.
5.11.2 or later.Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.