Introduction
A single unauthenticated request to Craft CMS's element search endpoint was enough to flip the administrator flag on user ID 1 and take over an entire site. Tracked as CVE-2026-123488, this SQL injection turns a search feature into a direct path for reading and writing the application database, including the users table.
Craft CMS, a product of Pixel & Tonic, is a customizable open source content management system that supports plugins, content APIs, and ecommerce. The vendor claims tens of thousands of Craft sites, including more than 1,500 among the top million websites, while W3Techs' November 2026 report places it at 0.1% of websites with an identified CMS. Craft is a specialized but established CMS. Its overall market share is modest, but an affected organization still carries real database and administrator account exposure.
Technical Information
The vulnerability is classified as CWE-89, SQL injection. According to the vendor advisory GHSA-qcvp-ggx3-97r6, the root cause is two weaknesses that combine to make the bug severe.
1. Untrusted input built into SQL text. The element search endpoint takes the attribute request parameter and concatenates it straight into the query without sanitizing it. In Craft, an attribute is a column or field name. Bound parameters such as :value cannot protect SQL identifiers like column names, so the standard defense of parameterizing values does not apply here. The documented fix approach is to check attribute values against an allowlist of known searchable attributes, or to strictly quote them as column names, before they reach the query builder.
2. Stacked queries through emulated prepares. Craft's PDO connection uses emulated prepared statements. This lets an injected semicolon start a second statement, which turns a read-only SELECT injection into full database write access. According to the advisory, an attacker can set the admin flag on user ID 1 or overwrite any account's password hash. Craft's permission checks treat that single admin column as a complete bypass, so no other changes are required to take over the site.
Attack Flow
The documented exploitation sequence is:
- An unauthenticated attacker supplies malicious input through the element search endpoint's
attributeparameter. - The application concatenates that input into SQL without sanitization.
- Emulated PDO prepares allow stacked statements to execute, extending a read-only injection into write access.
- The resulting database write capability modifies account privileges or password hashes. The vendor set the administrator flag on user ID 1 in the
userstable, then confirmed the change by reading the value back.
The CVSS 3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The vector describes a network attack with low complexity, no required privileges, no user interaction, and High confidentiality, integrity, and availability impacts. The CVE record reports 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, both Critical, while the vendor's GitHub advisory classifies the issue as High. These scores and classifications describe the vulnerability's characteristics. They are not evidence that every impact has occurred in an actual incident.
The primary advisories do not provide a complete endpoint URL, an executable exploit request, or a payload. No reconstructed exploit code is included here because none could be verified against the source material.
Patch Information
Craft CMS fixed this vulnerability in two maintained release lines, both published on September 17, 2026:
| Branch | Vulnerable range | Fixed release |
|---|---|---|
| Craft 4 | >= 4.0.0, < 4.18.9 | 4.18.9 |
| Craft 5 | >= 5.0.0, < 5.11.2 | 5.11.2 |
The maintainer tracks the issue as GHSA-qcvp-ggx3-97r6 ("SQL injection leading to privilege escalation", rated High, CWE-89). The GitHub advisory itself has no CVE ID. Its CVE field is null. NVD and VulnCheck, which is the CNA, link CVE-2026-123488 to this GHSA and list the same affected and unaffected ranges. That link is what ties the CVE to these releases.
What the release notes say: The official release notes for both 4.18.9 and 5.11.2 list GHSA-qcvp-ggx3-97r6 under one line: "Fixed high-severity permission escalation vulnerabilities." The changelog files it as privilege escalation, not SQL injection. That label describes the end result of an attack (an anonymous user becomes administrator) rather than the underlying bug. If you search the changelog for "SQL injection", you will only find the separate GHSA-mjj9-pjh4-r48g (GraphQL eager-load select injection). Search for the GHSA ID instead.
The two releases also fix several other advisories:
- 4.18.9: GHSA-mjj9-pjh4-r48g, GHSA-f6gf-r952-rxg6, GHSA-v4q3-2g5g-wjj6, GHSA-9hp6-3565-gvh5
- 5.11.2: the same set, plus several more permission-escalation, RCE, authorization-bypass and information-disclosure advisories
Upgrading closes all of these at once. You cannot install a fix for CVE-2026-123488 alone.
Limits of the public evidence: The advisory does not name its fix commit, and none of the sources consulted include a per-file diff. The only commit cited upstream, a29fe6f ("Finish 5.11.2"), is the release-wrap commit that updates CHANGELOG.md. It does not show the code change. We are not reproducing a code snippet because none could be verified. The authoritative fix is the tagged code in 4.18.9 and 5.11.2, both distributed through Composer as craftcms/cms.
Checking the patch is applied: Run composer show craftcms/cms. It should report at least 4.18.9 on Craft 4 or 5.11.2 on Craft 5. Any later 4.x or 5.x release also includes the fix.
Patching fixes the vulnerability, but the vendor does not present it as complete recovery. Craft's Security FAQ states that suspected compromise may require additional steps to secure accounts, content, and the hosting environment. Because this advisory describes changes to administrator privileges and password hashes, operators who suspect compromise should treat account and hosting integrity as a separate workstream from the upgrade itself.
Affected Systems and Versions
- Craft CMS 4: version 4.0.0 up to but not including 4.18.9. Fixed in 4.18.9.
- Craft CMS 5: version 5.0.0 up to but not including 5.11.2. Fixed in 5.11.2.
These are the fixed releases for this specific vulnerability. They may not be the newest Craft releases available. Any later 4.x or 5.x release also includes the fix.
Vendor Security History
Craft has an established patch and notification process, visible in its handling of prior incidents.
For CVE-2025-32432, Craft reports receiving the vulnerability report on April 7, 2025, releasing fixes on April 10, and marking the releases critical. After finding evidence suggesting exploitation on April 17, it emailed potentially affected license holders and published compromise assessment and recovery guidance. That guidance included disabling web access, removing payloads or backdoors, updating Craft and plugins, refreshing the security key and other private keys, rotating database credentials, and considering forced password resets. These are documented recovery measures from an earlier incident, not a playbook written for CVE-2026-123488.
Reporting on CVE-2025-23209 records CISA's warning that another Craft code execution flaw was being exploited. That vulnerability required an already compromised installation security key, and its scope, origin, and targets were not disclosed. Neither earlier incident establishes exploitation of CVE-2026-123488. The prerequisites of CVE-2025-23209 also should not be transferred to this SQL injection, which requires no stolen key.
In an October 2026 explanation of rising advisory volume, Craft attributes increased reporting partly to AI-assisted research and says that more advisories do not necessarily mean less secure software. The vendor also describes a standard 30-day disclosure window in which patched releases ship before full advisories. That is why the 4.18.9 and 5.11.2 fixes (September 17, 2026) precede both the detailed vendor advisory (October 22, 2026) and NVD publication (November 6, 2026).
References
- NVD: CVE-2026-123488
- CVE Record: CVE-2026-123488
- Craft CMS GitHub Security Advisory GHSA-qcvp-ggx3-97r6
- GitHub API: GHSA-qcvp-ggx3-97r6
- VulnCheck Advisory: Craft CMS SQL Injection via Element Search Endpoint
- Craft CMS Release 5.11.2 (GitHub API)
- Craft CMS Release 4.18.9 (GitHub API)
- Craft CMS Release 5.11.2
- Craft CMS Release 4.18.9
- Craft CMS Security FAQ
- Why Craft is Publishing More Security Advisories
- Craft CMS and CVE-2025-32432
- CISA flags Craft CMS code injection flaw as exploited in attacks
- W3Techs: Usage Statistics and Market Share of Craft CMS, November 2026
- CISA Known Exploited Vulnerabilities Catalog
