{"id":"CVE-2026-123490","published":"2026-11-06T15:17:18.483","lastModified":"2026-11-11T03:16:49.457","description":"Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-915"],"vendors":[],"products":[],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-r56r-f696-c8w9","tags":[]},{"url":"https://www.vulncheck.com/advisories/craft-cms-before-5.11.2-privilege-escalation-via-getowners-sandbox-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-r56r-f696-c8w9","tags":[]}],"hasPoc":true,"ai":{"summary":"A privilege escalation flaw in Craft CMS (5.8.17–5.11.1) allows authenticated control panel users to escalate privileges to administrator by exploiting improper query configuration handling in getOwners(), enabling arbitrary static PHP callable invocation. This occurs because caller criteria are not sanitized before execution.","exploitability":"Exploitation requires low skill and only an authenticated control panel account with minimal permissions; no user interaction or external dependencies are needed.","blast_radius":"Successful exploitation grants full administrative control over the CMS, enabling complete compromise of confidentiality, integrity, and availability of the application and potentially underlying systems.","remediation":"Upgrade to Craft CMS version 5.11.2 or later, which patches the improper sanitization of caller criteria in getOwners().","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","php-injection","cms","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:50:47.515Z"}}