{"id":"CVE-2026-124427","published":"2026-11-08T14:18:08.517","lastModified":"2026-11-10T21:46:29.520","description":"Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh","tags":[]},{"url":"https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.2-graphql-schema-scope-bypass-via-prev-next","tags":[]}],"exploitRefs":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh","tags":[]}],"hasPoc":true,"ai":{"summary":"A missing authorization check in Craft CMS versions 5.0.0 through 5.11.1 allows unauthenticated attackers to traverse and read entries from protected sections via GraphQL prev/next navigation fields, bypassing intended access controls. This enables enumeration of sensitive content including titles, slugs, and custom field data across otherwise restricted sections.","exploitability":"Exploitation is trivial for anonymous attackers with no authentication or user interaction required, leveraging publicly available GraphQL queries against the default endpoint.","blast_radius":"Successful exploitation exposes confidential content from multiple sections, potentially compromising sensitive internal data, credentials, or personally identifiable information stored in custom fields.","remediation":"Upgrade to Craft CMS 5.11.2 or later, which patches the authorization bypass in GraphQL prev/next field resolution.","detection":"Defenders should monitor GraphQL request logs for repeated sequential queries targeting 'prev' or 'next' fields on entries without authentication, especially when multiple requests chain across different section IDs or return data from sections the requester should not access; anomalous volume of unauthenticated GraphQL navigation requests may indicate enumeration attempts.","tags":["auth-bypass","graphql","cms","enumeration","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:43:22.800Z"}}