CVE-2026-123491

{
  "etk_id": "ETK-2026-3732",
  "cve_id": "CVE-2026-123491",
  "display_id": "CVE-2026-123491",
  "ghsa_id": "GHSA-6534-m2vq-3r2h",
  "euvd_id": "EUVD-2026-118291",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Craft CMS GraphQL eager-loading",
  "summary": "Craft CMS GraphQL eager-loading is vulnerable to SQL injection in CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2. An unauthenticated attacker may read database content, including sensitive application data, if they can reach the affected GraphQL functionality.",
  "mitigation": "Upgrade Craft CMS 4.x to 4.18.9 or later, or 5.x to 5.11.2 or later. Restrict access to GraphQL endpoints until the upgrade is complete.",
  "vendor": "craftcms",
  "product": "cms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, < 4.18.9"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "4.18.9"
      ],
      "package_name": "craftcms/cms",
      "purl": "pkg:composer/craftcms/cms"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.11.2"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "5.11.2"
      ],
      "package_name": "craftcms/cms",
      "purl": "pkg:composer/craftcms/cms"
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 58.29800958333333,
  "t0_at": "2026-11-06T15:00:52.189000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T16:19:49.703933+00:00",
      "days": 0.05483234876157407,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T15:00:52.189000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-06T15:00:52.189000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T15:00:52.189000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123491"
    }
  }
}