Advisory · CVE-2026-124427
Craft CMS GraphQL flaw lets anonymous users read entries from hidden sections
Craft CMS 5.0.0 before 5.11.2 contains an authorization bypass that lets anonymous GraphQL clients read out-of-scope section entries through prev/next fields, chaining from one visible entry to enumerate titles, slugs, and custom-field content from withheld sections, rated critical at CVSS 9.8; fixed in 5.11.2.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-124427
CWE-862 - Action timing
- Immediate
Explain it like I’m five
Craft CMS sections can be hidden from certain visitors, like rooms with a do-not-enter sign. A flaw in its GraphQL doorway lets a stranger follow the previous and next signs from a room they can see into rooms they cannot, reading titles and content from every hidden section.
- 01Anonymous GraphQL query
An unauthenticated client sends a GraphQL query against the Craft CMS site.
- 02One visible entry
The query starts from an entry the client is allowed to see.
- 03Prev/next hop
The response exposes prev/next fields pointing to entries in withheld sections.
- 04Chain continues
Each newly reached entry exposes further prev/next links, enumerating the hidden sections.
- 05Content read
Titles, slugs, and custom-field content from withheld sections are returned.
What happened
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass in its GraphQL handling. Anonymous clients can read out-of-scope section entries through prev/next fields, chaining next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, no privileges required, and no user interaction.
Anything placed in a withheld section was meant to stay out of public reach, and this flaw turns one visible entry into a map of the rest. The flaw is fixed in Craft CMS 5.11.2.
What to do
- Inventory Craft CMS deployments and record each version.
- Upgrade to Craft CMS 5.11.2 or later.
- Until upgraded, review which sections are withheld and what content they hold.
- Review GraphQL query logs for anonymous prev/next traversal.
- Treat content from withheld sections as potentially disclosed and handle it accordingly.
- Verify the deployed version after updating.
Management note
Hidden sections are a confidentiality boundary, and this flaw walks straight through it with no login. Patch first, then check what was in the sections that were supposed to stay hidden.