CVE-2026-124427
Received Received - Intake

Authorization Bypass in Craft CMS via GraphQL Next/Prev Fields

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124427
EUVD
EUVD-2026-119573

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms craft_cms From 5.0.0 (inc) to 5.11.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS versions 5.0.0 to 5.11.1 have an authorization bypass flaw in their GraphQL API. Anonymous users can exploit the prev/next fields to traverse from a visible entry to read restricted section entries, including titles, slugs, and custom-field content. This missing authorization check (CWE-862) allows enumeration of out-of-scope entries.

Detection Guidance

Check Craft CMS version with composer show craftcms/cms. If version is between 5.0.0 and 5.11.1, the system is vulnerable. Test GraphQL endpoint by sending queries with prev/next fields to see if restricted entries are accessible.

Impact Analysis

If you use Craft CMS 5.0.0 to 5.11.1 with GraphQL enabled, attackers can access sensitive data without authentication. They can read restricted content, enumerate entries, and potentially exfiltrate titles, slugs, or custom fields from sections meant to be private.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR (data protection) and HIPAA (patient data privacy). If sensitive content is accessed, it may result in non-compliance, legal penalties, or reputational damage due to unauthorized data disclosure.

Mitigation Strategies

Upgrade Craft CMS to version 5.11.2 or later immediately. If upgrading is not possible, disable the GraphQL API or restrict access to authenticated users only until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...