What happened
Craft CMS is a content management system used to run company websites, portals and online shops. On October 22, 2026, the Craft CMS developers published security advisory GHSA-qcvp-ggx3-97r6 on GitHub. It describes a flaw in the part of the system that handles content search (the so-called element search endpoint) and lists fixed versions 4.18.9 and 5.11.2.
On November 6, 2026, the flaw was assigned CVE-2026-123488. The identifier was issued by security company VulnCheck, which rates the flaw as critical in its own advisory. In ENISA’s European Vulnerability Database it is listed as EUVD-2026-118288.
No exploitation in the wild has been confirmed so far. The flaw is not in the CISA KEV catalog, and the European EUVD database does not record any active attacks. However, the vendor’s advisory describes the flaw in detail and is publicly available, so do not delay the update.
Why it is dangerous
This is an SQL injection flaw (CWE-89). A website talks to its database using SQL commands, and part of each query is filled in from what the visitor sends. If that input is not checked, an attacker can slip their own commands into the query. Think of a receptionist who reads a visitor’s note aloud and does whatever it says without thinking twice.
According to the vendor, Craft CMS inserts one parameter into a database query without checking it, and the database connection also allows several commands to run one after another. That means an attacker can not only read data but also write it.
The attack works over the internet and requires no login. The vendor describes how this can be used to set the administrator flag on a user account in the database or to overwrite the password of any account. The result is full access to the website’s admin area and its database, including user data or submitted forms if the site stores them. Neither the vendor nor VulnCheck mentions running code on the server or spreading further into the network.
Severity is expressed as a CVSS score from 0 to 10, and anything from 9 upward counts as critical. VulnCheck, which assigned the CVE, scores the flaw 9.8 under CVSS 3.1 and 9.3 under the newer CVSS 4.0. The vendor itself labels it “High” in its GitHub advisory.
EPSS estimates the probability that a flaw will be exploited in the next 30 days. As of November 7, 2026, it stands at 0.48%, higher than roughly 41% of known flaws. The CISA KEV catalog lists flaws whose exploitation the US agency CISA has confirmed. This flaw is not on it yet.
Who is affected
This affects anyone running a website on Craft CMS in these versions:
- Craft CMS 4: from 4.0.0 up to (but not including) 4.18.9
- Craft CMS 5: from 5.0.0 up to (but not including) 5.11.2
Craft CMS is written in PHP, installed as the craftcms/cms package via Composer, and runs on shared web hosting or a dedicated server with a database. Web agencies often use it to build company websites and online shops. If an agency built your site, ask them what it runs on.
Sites on 4.18.9, 5.11.2 or later are not affected. The vendor’s advisory does not mention the older Craft CMS 3 branch. If you still run it, plan a move to a current version.
How to check if you are affected
The easiest way is to log in to the Craft CMS control panel and open Utilities → System Report, which shows the exact version. The version is also displayed at the bottom of the control panel’s left-hand menu.
On the server, in the project directory (where composer.json lives), you can run these commands, which only print the version and change nothing:
composer show craftcms/cms | grep versionsgrep -A 2 '"name": "craftcms/cms"' composer.lockIf your version is below 4.18.9 on Craft CMS 4 or below 5.11.2 on Craft CMS 5, the site is vulnerable.
How to fix it
The vendor has released fixed versions 4.18.9 and 5.11.2. Its advisory does not mention any workaround short of updating, so updating is the only reliable protection.
- Back up the database and the website files.
- If you have a staging copy of the site, test the update there first.
- Update Craft CMS to at least 4.18.9 (Craft CMS 4) or 5.11.2 (Craft CMS 5). You can do this in the control panel under Utilities → Updates or from the command line with the commands below.
- Confirm the new version using the command from the check section and make sure the site works.
- Review the list of administrators as described in the last section of this article.
composer update craftcms/cms --with-all-dependencies
php craft upStart with sites reachable from the internet. Do not forget old staging or campaign instances, which are often publicly accessible and never updated. If an agency manages your site, send them CVE-2026-123488 and ask them to confirm the update is done.
If you cannot update right away, consider a web application firewall (WAF) with SQL injection rules as a general stopgap. This is not a vendor recommendation and does not replace the update.
What if you may already be compromised
Neither the vendor nor VulnCheck has published specific indicators of compromise. Since the attack aims at gaining administrator rights, focus on user accounts and changes to the site.
- In the control panel under Users, check who has administrator rights. Look for unknown accounts or ordinary accounts that suddenly have full rights.
- Make sure all administrators can still log in. A password that no longer works may mean someone overwrote it.
- Review web server logs as far back as you can and look for an unusually high number of search requests from a single IP address.
- Look for unexpected content changes, new pages, redirects or injected scripts.
This read-only database query lists administrators with their creation date, last login and last password change (add your table prefix, such as craft_, if you use one). An attacker writing directly to the database does not have to update these dates, so treat them as a hint only. The list of accounts itself is what matters most.
SELECT id, username, email, dateCreated, lastLoginDate, lastPasswordChangeDate FROM users WHERE admin = 1If you find anything suspicious, remove unknown accounts, change all administrator passwords and the database password, and bring in an incident response specialist. If the site stores personal data, also check whether you must report the incident under GDPR.