Privilege Escalation Vulnerability in Craft CMS by Craft Solutions

CVE-2026-123490

What is CVE-2026-123490?

Craft CMS versions prior to 5.11.2 are susceptible to a privilege escalation vulnerability due to insufficient sanitization of query configurations in the getOwners() function. This allows authenticated users of the control panel to execute arbitrary PHP callables through manipulated criteria, potentially escalating their permissions to administrative levels. Such weaknesses can lead to unauthorized access, making it critical for users to update their Craft CMS installations promptly to mitigate risks associated with this vulnerability.

References