GHSA-mjj9-pjh4-r48g: Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select

Published Nov 6, 2026

Updated

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized select argument to inject SQL expressions and read arbitrary database content, including password hashes and session tokens.

Event History

Nov 6, 2026

CVE Published

via OSV·03:00 PM

Data Sourced

via OSV·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Is authentication required for exploitation?

No. The vulnerability can be exploited by unauthenticated attackers who can submit the crafted GraphQL input.

Do GraphQL schema restrictions prevent the vulnerable arguments from being processed?

Not necessarily. Arguments on eager-loadable nodes that are absent from the public schema can still be copied into EagerLoadPlan criteria without cleansing.

What kind of data could an attacker obtain through this issue?

An attacker can inject SQL expressions to read arbitrary database content, including password hashes and session tokens.

GHSA-mjj9-pjh4-r48g: Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select

Event History

Frequently Asked Questions

Is authentication required for exploitation?

Do GraphQL schema restrictions prevent the vulnerable arguments from being processed?

What kind of data could an attacker obtain through this issue?

Company

Resources

Contact

Frequently Asked Questions

Is authentication required for exploitation?

Do GraphQL schema restrictions prevent the vulnerable arguments from being processed?

What kind of data could an attacker obtain through this issue?