CVE-2026-124427 is a critical authorization bypass in Craft CMS 5.0.0 through versions before 5.11.2. It lets anonymous GraphQL clients read entries from sections they are not permitted to see by following prev/next fields.
What Is It
The flaw is a missing authorization check (CWE-862) in Craft CMS's GraphQL layer. According to the record, anonymous GraphQL clients can use the prev and next fields on an entry they are allowed to see to reach entries in sections outside their schema scope. Starting from one visible in-scope entry, an attacker can follow next from entry to entry to list them. Along the way they can read titles, slugs and custom-field content from sections that should be hidden.
VulnCheck reported the issue on November 8, 2026. NVD lists its status as "Received," which means NVD has not yet run its own analysis.
Why It Matters
VulnCheck rates the issue 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. The vector means the flaw can be exploited over the network, with low complexity, no privileges and no user interaction.
The described impact is data exposure: anonymous users can read content that site owners deliberately left out of their public GraphQL schema. Sites that use section scoping to keep drafts, internal content or restricted material away from public API consumers should treat that boundary as broken until they patch. The vector also scores integrity and availability as high, but the published description only covers unauthorized reads.
KEV status: As of publication, CVE-2026-124427 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Active exploitation is therefore not confirmed by KEV at this time.
What's Vulnerable
- Vendor/Product: craftcms / cms
- Affected: 5.0.0 up to (but not including) 5.11.2
- Unaffected: 5.11.2
- Default status for other versions: unaffected
- Exposure condition: GraphQL access available to anonymous clients
NVD does not list any affected CPEs yet.
Patch Status
The record marks Craft CMS 5.11.2 as unaffected. Administrators running any 5.x release below 5.11.2 should upgrade to 5.11.2 or later. Until you can upgrade, check which sections your public GraphQL schema can reach and assume content in withheld sections can be read anonymously. Because the CVE is not listed in the CISA KEV catalog as of publication, there is no CISA KEV required action or remediation due date for it.