GHSA-r56r-f696-c8w9: Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

Published Nov 6, 2026

Updated

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Craft CMS to a version that resolves this vulnerability.
Fixed in 5.11.2

Event History

Nov 6, 2026

CVE Published

via OSV·03:00 PM

Data Sourced

via OSV·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Craft CMS installations running versions from 5.8.17 up to, but not including, 5.11.2 are affected. Exploitation requires an authenticated control panel user.

What level of access does an attacker need, and what can they achieve?

An attacker needs authenticated access to the Craft control panel. They can craft criteria that causes attacker-selected static PHP callables to be invoked and promotes every account to administrator.

Are unauthenticated visitors able to exploit this issue?

The available information identifies authenticated control panel users as the required attacker position. It does not indicate that unauthenticated visitors can exploit the vulnerability.

GHSA-r56r-f696-c8w9: Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What level of access does an attacker need, and what can they achieve?

Are unauthenticated visitors able to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What level of access does an attacker need, and what can they achieve?

Are unauthenticated visitors able to exploit this issue?