CVE-2026-123490
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 06, 2026
Vendor
unknown
Description
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.