CVE-2026-123491: Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized select argument to inject SQL expressions and read arbitrary database content, including password hashes and session tokens.
Event History
Frequently Asked Questions
Which deployments are affected?
Craft CMS versions from 4.0.0 through before 4.18.9, and versions from 5.0.0 through before 5.11.2, are affected. The vulnerable functionality is GraphQL eager-loading.
Does exploitation require authentication or privileged access?
No. The issue is exploitable by unauthenticated attackers through GraphQL requests.
What access could an attacker obtain?
An attacker can inject SQL expressions to read arbitrary database content. The disclosed examples include password hashes and session tokens.
What input condition enables the injection?
The vulnerable path involves arguments on eager-loadable nodes that are absent from the public schema. A parenthesized select argument can be supplied and copied into EagerLoadPlan criteria without cleansing.