CVE-2026-123490
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
67/100
Published: 2026-11-06
Modified: 2026-11-11
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
AT:
None
VC:
High
VI:
High
VA:
High
Description
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.