Since November 6, 2026, CVE-2026-123488 has tracked a serious SQL injection flaw in Craft CMS. According to the CVE record, the element search endpoint can be used to read and write the database, up to setting the admin flag or overwriting password hashes. VulnCheck, the CVE numbering authority for this record, scores it at 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. The good news: the fix has been part of Craft CMS 4.18.9 and 5.11.2 since September 17. If you have updated since then, you are protected. If you are still on older versions, you now have a very concrete reason to update.
What stands out is how differently the sources classify the flaw. Craft itself rates it “high”, VulnCheck “critical”, and on the question of whether a login is required, even the vendor advisory contradicts itself.
What is behind CVE-2026-123488
Craft CMS is a PHP-based content management system that is especially popular with agencies and for custom-built websites. The corresponding GitHub advisory GHSA-qcvp-ggx3-97r6 is titled “SQL injection leading to privilege escalation” and describes the mechanism in a few sentences:
- In the element search endpoint, the
attributeparameter is concatenated into the database query unsanitized. - Because PDO runs with emulated prepared statements, stacked statements execute as well, meaning several SQL commands in a row.
- According to the advisory, this gives read and write access to the application database.
The vendor is just as specific about the consequences. The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Because Craft short-circuits its permission checks on this single column, no further changes were needed to gain administrator rights. The same primitive could overwrite any account’s password hash. The advisory carries the internal report ID 1900 and lists no credits for the finder.
Why the emulated prepared statements carry so much weight: with real prepared statements, PHP sends the query and the values to the database server separately, which generally prevents stacked commands from being injected. With emulation, PDO builds the finished query as text itself and passes it on in one piece. If an unsanitized value ends up in that text, an attacker can append a second command after a semicolon, such as an UPDATE on the users table. That is exactly the combination the advisory describes. It has long been known that PDO emulates prepares by default with the MySQL driver, which is one reason framework code should strictly check parameters such as column names against an allowlist.
Authenticated or not? A contradiction in the advisory
For site operators this is the key question, and the primary sources do not answer it consistently. The summary line of Craft advisory GHSA-qcvp-ggx3-97r6 refers to an “authenticated SQL injection”, a flaw that requires a login. The “Impact” section of the same advisory, however, says the injection gives “unauthenticated read and write access” to the database.
The CVE record from VulnCheck (NVD entry CVE-2026-123488, last modified November 6, 2026) follows the second reading. It expressly describes an “unauthenticated SQL injection” and scores it with Privileges Required: None — network attack, low complexity, no privileges and no user interaction required. That results in 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. Craft has not attached CVSS scores to its advisory and lists the fix in its changelog under “high-severity permission escalation vulnerabilities”. Both fit better with a scenario that assumes some level of access.
As of November 9, 2026 (a fresh check of the primary sources): Craft has not resolved the contradiction in its advisory — the summary still says “authenticated”, the Impact section still says “unauthenticated”. The NVD/CVE text is unchanged at “unauthenticated”. Which reading is correct still cannot be settled from the public documents. In practice the cautious assumption remains the right one: anyone running vulnerable versions should assume an attack without login is possible.
Affected and patched versions
According to the advisory and the CVE record, these versions are affected:
- Craft CMS 4.0.0 up to, but not including, 4.18.9
- Craft CMS 5.0.0 up to, but not including, 5.11.2
According to the official changelogs, both fixed versions were released on September 17, 2026. They closed not just this flaw but a whole bundle: for 4.18.9, Craft lists another SQL injection (GHSA-mjj9-pjh4-r48g), an RCE flaw (GHSA-9hp6-3565-gvh5), an information disclosure issue and a second privilege escalation, all rated high. Version 5.11.2 adds further fixes, including a second RCE flaw and several moderate and low severity authorization issues.
The timeline is typical of coordinated disclosure: patch on September 17, GitHub advisory published on October 22, CVE record on November 6. The current release in the 5.x line is now 5.12.0.1 from November 3; the newest 4.x version in the changelog is still 4.18.9.
CVE-2026-123488 is not in the KEV catalog maintained by the US agency CISA, which lists actively exploited flaws (catalog version 2026.11.06). The primary sources do not link to a public exploit.
What Craft site operators should do now
- Check your version. In the control panel (System Report under Utilities) or with
composer show craftcms/cms. Anything below 4.18.9 or 5.11.2 is vulnerable. - Update. At least to 4.18.9 or 5.11.2, preferably to the latest release in your line. Because the fix releases close several other flaws as well, the update is worthwhile regardless of this CVE.
- Review users. The obvious traces of a successful attack are unexpected administrator accounts or changed passwords. As general practice, not as guidance from the advisory, check the users table for admin flags that should not be set and for suspicious modification dates.
- Analyze logs. Unusual requests to the search endpoint with odd values in the
attributeparameter can be an indicator.
If you find signs of compromise, reset passwords, end sessions and, because the flaw allows write access to the entire database, compare content and configuration against a clean backup.
Context
The flaw follows a familiar pattern: a single unsanitized parameter is enough if the database layer allows stacked queries. The combination of emulated prepared statements and string concatenation turns a read flaw into a write flaw, and a data leak into an account takeover. We described similar problems with the SQL injection flaws in MariaDB Connector/Node.js. PHP developers may also want to read about the fix in the Symfony Serializer (CVE-2026-118515), and the case of the WordPress updater added to CISA KEV shows how quickly CMS flaws can move onto the list of actively exploited vulnerabilities.
For Craft users, the situation is still manageable: the patch has been available for almost eight weeks. If you update regularly, there is nothing else to do. If you do not, now is the time to catch up, before the new CVE number turns into a KEV entry.
