Advisory · CVE-2026-123490
Craft CMS control panel privilege escalation via unsanitized getOwners criteria
Craft CMS 5.8.17 before 5.11.2 lets an authenticated control panel user invoke attacker-selected static PHP callables through getOwners() because the criteria are applied to the element query without cleansing, promoting every account to administrator.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-123490
CWE-915 - Action timing
- Immediate
Explain it like I’m five
Craft lets templates ask for the owners of an item, and it trusts whatever instructions come with that question. A logged-in editor can smuggle in instructions that run a built-in function to promote every account to admin.
- 01Sandboxed template crafted
An authenticated control panel user crafts a sandboxed Twig template calling object.getOwners() with attacker-controlled criteria, reachable from the relational-condition object template feature.
- 02Criteria applied raw
Craft applies the criteria array directly to an ElementQuery without the cleansing applied on the controllers direct query paths.
- 03Yii behavior attached
Special keys in the criteria let the attacker attach an AttributeTypecastBehavior and register a wildcard event handler.
- 04Callable invoked
ElementQuery all() fires a query event and invokes the attacker-selected public static PHP callable.
- 05Every account promoted
The attacker selects User updateAll with admin set to true, which promotes every account in the users table, including their own.
What happened
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability in getOwners(). Craft exposes NestedElementInterface getOwners to sandboxed Twig, and its implementation applies the callers array directly to an ElementQuery and executes it, applying neither the component config cleansing nor the query criteria cleansing used on the controllers direct paths. An authenticated control panel user can reach this method from the relational-condition object template feature. Yii treats special keys in the criteria as behavior and event configuration, allowing the attacker to attach a typecast behavior and register a wildcard event handler, so ElementQuery all() invokes an attacker-selected public static PHP callable. The vendor advisory confirms the production-bundled escalation sink: User updateAll with admin set to true promotes every account in the users table. The record rates it high at CVSS 8.8.
The precondition is a real permission boundary: the attacker needs an authenticated control panel account able to use the relational-condition template feature. The primitive itself is generic, since any public static PHP callable accepting the attacker-controlled value can be selected, so the demonstrated admin promotion is the floor, not the ceiling. The fix is in Craft CMS 5.11.2, per the NVD affected range and the 5.11.2 release notes, which also fix several other security issues; this advisory covers only this CVE.
What to do
- Inventory Craft CMS 5.x installations and record each version.
- Upgrade to Craft CMS 5.11.2 or later.
- Until upgraded, audit control panel accounts and restrict who can use the relational-condition object template feature.
- Review logs for unusual getOwners or template invocations and for changes to the users table.
- Check the users table for unexpected admin flags and investigate any account whose privileges changed.
- Verify the deployed version after updating.
Management note
A template sandbox that lets a logged-in editor run arbitrary framework callables is a privilege boundary failure, not a minor hardening gap. Patch, then audit who held control panel access while the window was open.