Craft CMS has fixed a critical security flaw that allowed anonymous visitors to read content site owners had deliberately kept out of reach. The vulnerability, tracked as CVE-2026-124427, was published on 8 November 2026 and carries a CVSS score of 9.3 under version 4.0, and 9.8 under version 3.1. It affects Craft CMS versions 5.0.0 through 5.11.1 and is fixed in version 5.11.2.

The flaw sits in the GraphQL API that many Craft sites expose to power headless front ends and apps. According to the National Vulnerability Database description, an unauthenticated GraphQL client could use the prev and next fields on entries to step outside the sections its token was allowed to see. Starting from a single visible entry, an attacker could chain those hops to enumerate other entries and read their titles, slugs and custom-field content from sections that were meant to be withheld.

The same 5.11.2 release fixes several related flaws. CVE-2026-124430, scored 8.8, is a remote code execution weakness that let non-administrator control panel users obtain signed Twig templates and run operating system commands. CVE-2026-124429, scored 7.5, allowed unauthenticated visitors registering an account to reclaim a deactivated account and inherit its permissions. Two further authorisation bypasses, CVE-2026-124426 and CVE-2026-124431, were also patched.

Site owners should also note a separate unauthenticated SQL injection flaw, CVE-2026-123488, scored 9.8, in Craft's element search endpoint. Its CVE record appeared on 6 November, the same day a public proof of concept was published, although no in-the-wild exploitation has been confirmed and it is not on CISA's exploited-vulnerabilities list. The fix shipped earlier, on 17 September, in versions 4.18.9 and 5.11.2.

The advice is straightforward: update Craft 5 sites to 5.11.2 or later. Sites still on Craft 4 should move to 4.18.9, which is the final release for that branch after security support ended on 30 April 2026, and then audit the users table for administrator flags or password hashes that changed without a reset.