CRITICAL 9.8 CVE-2026-124427 Published 8 Nov 2026

Craft CMS GraphQL Authorization Bypass Exposes Hidden Entries

Worried this affects your website?

Craft CMS versions from 5.0.0 before 5.11.2 contain an authorization bypass vulnerability in GraphQL.

Anonymous GraphQL clients can read out-of-scope section entries via the prev/next fields.

Affected versions: 5.0.0 through 5.11.1
Attackers can chain next hops from a visible in-scope entry to enumerate entries
Exposed data includes titles, slugs, and custom-field content from withheld sections