Executive Summary
CVE-2026-124427 is an authorization bypass in Craft CMS versions from 5.0.0 up to (but not including) 5.11.2. The flaw is rated CVSS 9.8 (Critical) and was published to the NVD on 2026-11-08.
Anonymous GraphQL clients can read section entries that are outside their permitted scope by abusing the prev and next navigation fields.
Vulnerability Details
| Field | Value |
|---|---|
| CVE | CVE-2026-124427 |
| CVSS | 9.8 |
| Affected | Craft CMS 5.0.0 before 5.11.2 |
| Fixed in | 5.11.2 |
| Authentication | None (anonymous) |
| Class | Authorization bypass (GraphQL) |
An attacker needs only one entry that is visible within the GraphQL schema's allowed scope. From that entry, they can chain next hops to step through neighbouring entries that the schema should not expose, enumerating them and reading titles, slugs, and custom-field data.
Impact
- Disclosure of unpublished or restricted content held in other sections
- Enumeration of the full entry set via repeated hops
- Exposure of custom-field values that site owners assumed were private
The NVD description covers confidentiality exposure; no code-execution path is described in the source.
Remediation
- Upgrade Craft CMS to 5.11.2 or later.
- If you cannot upgrade immediately, disable the public GraphQL endpoint or require a token for it.
- Review GraphQL access logs for long chains of
nextorprevqueries from anonymous clients. - Audit which sections and fields the public GraphQL schema exposes, and treat anything reachable as public.