CVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next

Beschreibung

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-xpg7-m6gm-4xfh) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next third-party-advisory