CVE-2026-123490: Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.11.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Craft CMS control panel user can exploit it. The issue affects Craft CMS versions from 5.8.17 up to, but not including, 5.11.2.
What level of access can exploitation provide?
A successful exploit can promote every account to administrator, resulting in privilege escalation across the CMS.
What must an attacker do to trigger the vulnerability?
The attacker must be able to submit crafted criteria through the affected getOwners() path. Those criteria can cause invocation of attacker-selected static PHP callables.
How can I remediate the issue?
Upgrade Craft CMS to version 5.11.2 or later. The provided information does not identify a workaround for deployments that cannot be upgraded immediately.