{"id":"CVE-2026-124427","kind":"vulnerability","aliases":["CVE-2026-124427"],"related":[],"title":"Craft CMS: anonymous GraphQL prev/next fields leak entries from hidden sections","description":"Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.","summary":"Craft CMS versions 5.0.0 through 5.11.1 fail to enforce section permissions on the GraphQL prev and next entry fields. An anonymous client can walk from one visible entry to others and read titles, slugs and custom field content from sections that are meant to be withheld.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","graphql","package","php","self-hosted"],"not_affected_if":["auth-required","no-graphql","version-5.11.2-or-later"],"how_to_check":null,"fix":"- Craft CMS: move to `5.11.2` or later.","status":"open","published_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:48:50+00:00","updated_at":"2026-11-08T14:48:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-08T14:48:50Z","model":"claude-haiku-5-5","output":{"fix":"- Craft CMS: move to `5.11.2` or later.","reach":"internet","title":"Craft CMS: anonymous GraphQL prev/next fields leak entries from hidden sections","impact":"medium","summary":"Craft CMS versions 5.0.0 through 5.11.1 fail to enforce section permissions on the GraphQL prev and next entry fields. An anonymous client can walk from one visible entry to others and read titles, slugs and custom field content from sections that are meant to be withheld.","audience":"businesses","category":"package","nicknames":[],"who_cares":["craft-cms","php","self-hosted","graphql"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"anonymous visitors read content from withheld sections","analyst_note":"Confirm whether the GraphQL endpoint must be enabled for the flaw to apply; the sources do not say.\n","how_to_check":"- Check the Craft CMS version in `composer.json` or with `php craft version`, and see whether it is between `5.0.0` and `5.11.1`.\n- Check whether the public GraphQL endpoint is enabled and whether anonymous access to it is allowed for schemas that expose entries.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-graphql","auth-required","version-5.11.2-or-later"],"who_is_affected":"Sites running Craft CMS 5.x before 5.11.2 that expose GraphQL to anonymous visitors and have sections whose entries are meant to be private. Sites that do not use GraphQL, or that require login for GraphQL, are less exposed. unknown whether managed hosting changes the risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00077,"input_tokens":4622,"output_tokens":615,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124427':14A,17A '-2026':13A,16A '5.0.0':30B,76C '5.11.1':32B '5.11.2':78C 'allow':85C 'anonym':3A,47B,86C 'attack':100C 'author':81C 'bypass':82C 'chain':102C 'client':48B,88C 'cms':2A,20B,28B,74C 'contain':79C 'content':64B,123C 'craft':1A,19B,27B,73C 'craft-cm':18B 'custom':62B,121C 'custom-field':120C 'cve':12A,15A 'enforc':35B 'entri':8A,44B,54B,96C,111C,114C 'enumer':113C 'fail':33B 'field':6A,45B,63B,99C,122C 'graphql':4A,21B,40B,87C 'hidden':10A 'hop':104C 'host':26B 'in-scop':108C 'leak':7A 'meant':69B 'next':43B,103C 'one':52B,106C 'other':56B 'out-of-scop':91C 'packag':22B 'permiss':37B 'php':23B 'prev':41B 'prev/next':5A,98C 'read':58B,90C,116C 'scope':94C,110C 'section':11A,36B,66B,95C,126C 'self':25B 'self-host':24B 'slug':60B,118C 'titl':59B,117C 'version':29B 'via':97C 'visibl':53B,107C 'vulner':83C 'walk':50B 'withheld':72B,125C","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS 5.x before 5.11.2 that expose GraphQL to anonymous visitors and have sections whose entries are meant to be private. Sites that do not use GraphQL, or that require login for GraphQL, are less exposed. unknown whether managed hosting changes the risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["craftcms","critical","graphql","package","php","selfhosted"],"campaign_type":null,"search_a":"'-124427':14A,17A '-2026':13A,16A 'anonym':3A 'cms':2A 'craft':1A 'cve':12A,15A 'entri':8A 'field':6A 'graphql':4A 'hidden':10A 'leak':7A 'prev/next':5A 'section':11A","search_b":"'5.0.0':30B '5.11.1':32B 'anonym':47B 'client':48B 'cms':20B,28B 'content':64B 'craft':19B,27B 'craft-cm':18B 'custom':62B 'enforc':35B 'entri':44B,54B 'fail':33B 'field':45B,63B 'graphql':21B,40B 'host':26B 'meant':69B 'next':43B 'one':52B 'other':56B 'packag':22B 'permiss':37B 'php':23B 'prev':41B 'read':58B 'section':36B,66B 'self':25B 'self-host':24B 'slug':60B 'titl':59B 'version':29B 'visibl':53B 'walk':50B 'withheld':72B","search_c":"'5.0.0':76C '5.11.2':78C 'allow':85C 'anonym':86C 'attack':100C 'author':81C 'bypass':82C 'chain':102C 'client':88C 'cms':74C 'contain':79C 'content':123C 'craft':73C 'custom':121C 'custom-field':120C 'entri':96C,111C,114C 'enumer':113C 'field':99C,122C 'graphql':87C 'hop':104C 'in-scop':108C 'next':103C 'one':106C 'out-of-scop':91C 'prev/next':98C 'read':90C,116C 'scope':94C,110C 'section':95C,126C 'slug':118C 'titl':117C 'via':97C 'visibl':107C 'vulner':83C 'withheld':125C","cause_entry":null,"cause_path":null,"first_public_at":"2026-10-23T09:03:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124427","severity":null,"published_at":"2026-11-08T14:18:08+00:00","modified_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102038,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T09:03:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102039,"url":"https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.2-graphql-schema-scope-bypass-via-prev-next","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}