CVE-2026-123491— Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select

Quick assessment

Affected

craftcms cms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Craft CMS 4.0.0 至 4.18.9 版本（不含 4.18.9）以及 5.0.0 至 5.11.2 版本（不含 5.11.2）在 GraphQL 的预加载（eager-loading）功能中存在 SQL 注入漏洞。具体而言，那些未在公开 Schema 中声明的、可预加载节点上的参数，会被直接复制到 EagerLoadPlan 的查询条件中，且未经过任何清理或过滤。未认证的攻击者可利用带括号的 SELECT 子句作为参数，注入任意 SQL 表达式，从而读取数据库中的任意内容，包括密码哈希值和会话令牌。

CVSS 8.2 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select

Source: CVE Program / CVE List V5

Vulnerability Description

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized select argument to inject SQL expressions and read arbitrary database content, including password hashes and session tokens.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
craftcms	cms	4.0.0 ~ 4.18.9	-
craftcms	cms	5.0.0 ~ 5.11.2	-

II. Public POCs for CVE-2026-123491

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123491

请登录查看更多情报信息。

Other References for CVE-2026-123491 (2)

https://github.com/craftcms/cms/security/advisories/GHSA-mjj9-pjh4-r48g vendor-advisory
https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-unauthenticated-sql-injection-via-graphql-eager-load-select third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123491

Same Patch Batch · craftcms · 2026-11-06 · 4 CVEs total

CVE-2026-123488	9.8 CRITICAL	Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint
CVE-2026-123490	8.8 HIGH	Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass
CVE-2026-123489	7.1 HIGH	Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria

IV. Related Vulnerabilities

Same product: cms

Same vendor: craftcms

Same weakness: CWE-89