Craft CMS CVE-2026-123488: Unauthenticated SQL Injection Can Enable Administrator Takeover

Craft CMS CVE-2026-123488 allows unauthenticated database read and write access through the element endpoint, according to the vendor advisory and VulnCheck CNA record. That access can be used to change administrator status or overwrite password hashes. Affected Craft 4 and Craft 5 deployments should move to at least 4.18.9 or 5.11.2 respectively, following supported upgrade procedures.

This is newly numbered coverage of an already patched issue, not a newly released emergency fix. The vendor changelogs date both fixed releases September 17, 2026. The GitHub security advisories were published October 22, and the four CVE records discussed here were published November 6. Those dates describe different events and must not be conflated.

Technical Information

CVE-2026-123488: unauthenticated element- SQL injection

The vendor describes an unsanitized query attribute and emulated PDO prepares allowing stacked SQL statements. The published impact is unauthenticated read and write access to the application database. The advisory reports administrator escalation through a changed administrator flag and notes that account password hashes can also be overwritten.

For CVE-2026-123488, VulnCheck, the CNA, assigns CVSS 4.0 9.3 and CVSS 3.1 9.8, both Critical. Craft labels its advisory High. These are separately attributed assessments, not a vendor-issued 9.8 score. CWE-89 identifies the SQL-injection weakness. The impact justifies prompt remediation without asserting that every affected site has been attacked.

CVE-2026-123489: authenticated blind SQL injection

This separate issue requires an authenticated control-panel user. Sandbox-exposed getNext() and getPrev() criteria can reach SQL-bearing query properties without adequate cleansing. The vendor describes a conditional SQL oracle under the Craft database account.

For CVE-2026-123489, VulnCheck assigns 7.1 under both CVSS 4.0 and 3.1, High. This is not the unauthenticated stacked-statement write primitive described for CVE-2026-123488, and the same administrator-takeover narrative should not simply be copied across.

CVE-2026-123490: authenticated administrator privilege escalation

This flaw affects a narrower Craft 5 range. An authenticated control-panel user can misuse sandbox-exposed getOwners() criteria to select static PHP callables; the vendor describes a resulting ability to promote accounts to administrator. The vendor's path also requires a nested reference element reachable through the relational-condition object-template feature.

For CVE-2026-123490, VulnCheck assigns CVSS 4.0 8.7 and CVSS 3.1 8.8, High. The vendor classifies the weakness as CWE-915. Do not broaden the published impact to an independently demonstrated unauthenticated operating-system compromise or apply this CVE to Craft 4.

CVE-2026-123491: conditional unauthenticated GraphQL SQL injection

The vendor describes SQL-expression injection through GraphQL eager-loading criteria, allowing database reads including password hashes and session tokens. For CVE-2026-123491, VulnCheck assigns CVSS 4.0 8.8 and CVSS 3.1 8.2, High.

Its prerequisites matter: a public GraphQL schema must allow anonymous reads of at least one section or asset volume, but not user groups, and there must be an entry with an author or an asset with a populated uploader identifier. This is not a claim that every Craft GraphQL configuration is equally exposed. The vendor distinguishes it from an earlier eager-load callable issue; that earlier fix does not close this SQL-expression path.

Affected Product Versions

These are the minimum fixed versions for this batch, not a statement that those older releases are the best current maintenance target. Confirm the supported upgrade path and subsequent security updates for the deployed branch and plugins.

CVE-2026-123488, CVE-2026-123489, CVE-2026-123490 and CVE-2026-123491 are not in CISA's Known Exploited Vulnerabilities catalog (catalogVersion 2026.11.06, checked November 9, 2026 at 09:21 Asia/Jerusalem UTC+2). The reviewed vendor advisories and CNA records do not report attacks in the wild. This does not prove that exploitation has never occurred.

The vendor advisories themselves describe proof-of-concept results; this review did not independently validate exploit functionality. Public technical detail or a reported proof of concept is not evidence of an active campaign. No exploit code was tested for this advisory, and no EPSS estimate is used.

Workaround and Mitigation

Update affected Craft 4 deployments to at least 4.18.9 and affected Craft 5 deployments to at least 5.11.2 using supported procedures. Record the installed Composer package version and validate normal application behavior after the change. Patching this batch does not establish that unrelated Craft or runtime vulnerabilities are remediated.

While scheduling the update, restrict unnecessary control-panel access and review public GraphQL exposure. These are operational risk-reduction measures, not a verified universal workaround. In particular, reducing control-panel users does not address the unauthenticated element- issue. Although the GraphQL advisory describes a schema condition that removes that particular path, broadening user-group read permissions should not be treated as a preferred security fix; it changes the data-exposure model and does not address the other CVEs.

Review unexpected administrator changes, password resets and suspicious activity with the incident-response team. Installing a fixed release alone does not establish whether earlier unauthorized access occurred.

Indicators of Compromise

No validated CVE-specific malicious IP addresses, domains or file hashes were established in the primary sources reviewed. Unexpected administrator privileges or account changes can be investigative leads, but they are not definitive CVE-specific indicators. Preserve relevant application and access logs when suspicious activity warrants investigation; do not invent signatures from an untested exploit report.

What to Ask Your Website Suppliers Today

Ask agencies, managed hosting partners and application suppliers whether they operate Craft CMS for your sites, which branch and exact package version is deployed, and who owns the update. Request version evidence, a completion time and confirmation of post-update testing rather than a generic assurance that the CMS is maintained.

Where public GraphQL or third-party control-panel accounts are used, ask the supplier to assess the corresponding prerequisites separately. Request investigation of unexplained administrator or password changes when warranted. Track remediation and unresolved applicability questions to closure. The supplier relevance is qualitative; this is not an internet-scale exposure estimate.

Need help working through website and CMS suppliers exposed to Craft CMS CVE-2026-123488 and related fixes? Our team can help you prioritize them and track their answers. Talk to an expert

Craft: element- SQL injection

Craft: authenticated blind SQL injection

Craft: getOwners privilege escalation

Craft: GraphQL SQL injection and prerequisites

Craft 4 release changelog and Craft 5 release changelog

VulnCheck CVE-2026-123488 advisory

CNA 123488 , 123489 , 123490 , 123491

CISA vulnerability catalog JSON feed — catalogVersion 2026.11.06, checked November 9, 2026 at 09:21 Asia/Jerusalem UTC+2.