---
id: "CVE-2026-124427"
page: "https://infrastack.ai/live/CVE-2026-124427"
kind: "vulnerability"
aliases: ["CVE-2026-124427"]
title: "Craft CMS: anonymous GraphQL prev/next fields leak entries from hidden sections"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["craft-cms", "graphql", "package", "php", "self-hosted"]
not_affected_if: ["auth-required", "no-graphql", "version-5.11.2-or-later"]
published_at: "2026-11-08T14:18:08+00:00"
first_seen_at: "2026-11-08T14:48:38+00:00"
updated_at: "2026-11-08T14:48:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124427", "first_seen_at": "2026-11-08T14:48:38+00:00"}]
exploit_sources: []
---

# Craft CMS: anonymous GraphQL prev/next fields leak entries from hidden sections

Link for people: https://infrastack.ai/live/CVE-2026-124427 (this .md is for agents)

Craft CMS versions 5.0.0 through 5.11.1 fail to enforce section permissions on the GraphQL prev and next entry fields. An anonymous client can walk from one visible entry to others and read titles, slugs and custom field content from sections that are meant to be withheld.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Craft CMS: move to `5.11.2` or later.

## Timeline

- 2026-11-08T14:48:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124427

## Documents

- [advisory] Vendor advisory: github.com https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.2-graphql-schema-scope-bypass-via-prev-next

## From the sources

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_