CVE-2026-124427

Summary

A missing authorization check in Craft CMS versions 5.0.0 through 5.11.1 allows unauthenticated attackers to traverse and read entries from protected sections via GraphQL prev/next navigation fields, bypassing intended access controls. This enables enumeration of sensitive content including titles, slugs, and custom field data across otherwise restricted sections.

Exploitability

Exploitation is trivial for anonymous attackers with no authentication or user interaction required, leveraging publicly available GraphQL queries against the default endpoint.

Blast radius

Successful exploitation exposes confidential content from multiple sections, potentially compromising sensitive internal data, credentials, or personally identifiable information stored in custom fields.

Detection

Defenders should monitor GraphQL request logs for repeated sequential queries targeting 'prev' or 'next' fields on entries without authentication, especially when multiple requests chain across different section IDs or return data from sections the requester should not access; anomalous volume of unauthenticated GraphQL navigation requests may indicate enumeration attempts.

Prioritized remediation

Upgrade to Craft CMS 5.11.2 or later, which patches the authorization bypass in GraphQL prev/next field resolution.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.