CVE-2026-123490High· 8.8▾ TwilightCraft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected stati…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.
cms >= 5.8.17 < 5.11.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72778High· 8.8Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling
CVE-2026-56382High· 7.2Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController
CVE-2026-56383Medium· 4.8Craft CMS - Stored XSS in Table Field via Row Heading Column Type
CVE-2026-56385Medium· 4.3Craft CMS - Authorization Bypass in assets/preview-file Endpoint
CVE-2026-56381Medium· 4.8Craft CMS - Stored XSS via User Group Name in User Permissions Page
CVE-2026-56384Medium· 4.3Craft CMS - Missing Authorization in assets/preview-thumb Endpoint