CVE-2026-123490Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

Açıklama

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-r56r-f696-c8w9) vendor-advisory
• VulnCheck Advisory: Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass third-party-advisory