It affects Craft CMS versions 5.0.0 through 5.11.1 and is fixed in version 5.11.2.The Craft advisory says navigation fields can return entries from sections excluded by the schema's read scope. This breaks the intended authorization boundary for public or scoped GraphQL access.
What it allows
How Does CVE-2026-124427 Affect Craft CMS?
An attacker can start from an entry that the schema permits them to read. The vulnerable navigation behavior can then cross into a section that the operator withheld from that schema.
The advisory says an anonymous internet client may need only the GraphQL endpoint URL. The client needs no account, cookie, CSRF token, elevated session, development mode, or administrative configuration access.
Exposed data may include titles, slugs, unique identifiers, publication dates, and full custom-field content. The advisory also says affected behavior can reveal entries across the site's entry list.
Who is affected
Craft CMS versions 5.0.0 through 5.11.1 are affected. Craft CMS 5.11.2 is the patched release identified by the vendor advisory.
Exposure requires GraphQL with a public schema or a scoped private token. The schema must permit one section, withhold another, and expose an entry type shared by both sections.
What to do
-
Upgrade Craft CMS to version 5.11.2 or later
Prioritize internet-facing and headless deployments that expose GraphQL. Confirm the running Craft CMS version after deployment.
-
Review GraphQL schema exposure
Brandefense recommends inventorying public schemas and scoped private tokens. Identify schemas that permit one section while withholding another section with the same entry type.
-
Restrict GraphQL while the update is pending
Brandefense recommends disabling unnecessary public schemas or limiting endpoint access until the update is complete. Preserve required access for approved integrations.
-
Investigate unexpected content access
Brandefense recommends reviewing available web and application logs for unusual GraphQL navigation activity. Investigate requests involving accounts or tokens that should have narrow content access.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124427?
It is a missing-authorization vulnerability in Craft CMS GraphQL. A client can cross a schema's section boundary and read content from a withheld section.
Which Craft CMS versions are affected by CVE-2026-124427?
The Craft CMS advisory lists versions 5.0.0 through 5.11.1 as affected. It identifies Craft CMS 5.11.2 as the patched version.
Can CVE-2026-124427 be exploited without an account?
Yes, when a vulnerable site exposes an affected public GraphQL schema. The advisory says an anonymous client may need only the endpoint URL.
What should Craft CMS administrators do first?
Upgrade Craft CMS to version 5.11.2 or later. Administrators should also review public schemas and scoped tokens while completing the update.
