Craft CMS API Vulnerability Affects Non-Admin Users
CVE-2026-115935

8.7HIGH

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115935?

A vulnerability exists in Craft CMS where a non-admin user, granted 'accessCp', can inject newline characters into the X-Craft-Plugin-Licenses header. This input is processed without sanitization and is sent directly to the .env writer, allowing an attacker to replace the existing CRAFT_SECURITY_KEY with a manipulated version. This substitution enables the crafting of a signed login redirect that could execute arbitrary system calls via Twig's system() function. It's crucial to address both the API header injection vector and any existing signature verification issues independently to fully mitigate the risk.

Affected Version(s)

cms 5.0.0 < 5.11.2

cms 4.0.0 < 4.18.9

References

https://www.hckrt.com/hacktivity/HCKRT-WM3VSE
third-party-advisorytechnical-descriptionmitigation
https://github.com/craftcms/cms/releases/tag/5.11.2
release-notes
https://github.com/craftcms/cms
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamed Wagdy (@Kalawy)
Hackrate
.