CVE-2026-123490

Summary

A privilege escalation flaw in Craft CMS (5.8.17–5.11.1) allows authenticated control panel users to escalate privileges to administrator by exploiting improper query configuration handling in getOwners(), enabling arbitrary static PHP callable invocation. This occurs because caller criteria are not sanitized before execution.

Exploitability

Exploitation requires low skill and only an authenticated control panel account with minimal permissions; no user interaction or external dependencies are needed.

Blast radius

Successful exploitation grants full administrative control over the CMS, enabling complete compromise of confidentiality, integrity, and availability of the application and potentially underlying systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Craft CMS version 5.11.2 or later, which patches the improper sanitization of caller criteria in getOwners().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.