External risk intelligence

Craft CMS GraphQL Authorization Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-124427

Craft CMS is a web content management system designed to serve web content. Its GraphQL interface is a common, often internet-facing, API endpoint used for front-end data fetching. Because the product is typically deployed as a public-facing web application and the vulnerability exists within its standard GraphQL implementation, it is commonly accessible from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns Craft CMS, a web content management system, specifically a vulnerability within its GraphQL interface. An issue exists that could allow unauthorized access to content, potentially revealing sensitive information from sections that should be protected. The main concern is confirming relevance and exposure to our specific deployments.

Bypass of content access controls.
Enables unauthorized content exposure.
Assess impact to protected data.

Attack Path

How an attacker could exploit the issue

An attacker can target a Craft CMS instance through its GraphQL interface, bypassing authorization controls to access sensitive information. By exploiting the previous/next field functionality, an attacker can traverse visible entries to enumerate and extract data from restricted sections. This can lead to the disclosure of titles, slugs, and custom field content that should otherwise be kept confidential.

No authentication required.
Anonymous GraphQL clients can trigger.
Exposure of sensitive section content.

Live Threat

Current exploitation, exposure, and threat context

An authorization bypass in Craft CMS's GraphQL endpoint allows unauthenticated clients to access information from sections they should not be able to view. Attackers can leverage this by chaining "next" hops through visible entries to discover and read titles, slugs, and custom field content from restricted sections.

Sensitive content from withheld sections.
Anonymous clients could enumerate entries.
Exposure of titles, slugs, and custom fields.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Craft CMS impacts its GraphQL API, potentially exposing sensitive data to unauthenticated users. The platform or application owner is responsible for assessing the exposure and coordinating remediation. The first step is to confirm the presence of the affected Craft CMS versions, verify if the GraphQL endpoint is externally accessible, and identify the specific application or content sections that might be at risk.

Application owners should initiate review.
Verify GraphQL endpoint exposure.
Plan remediation during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Craft CMS and how is it used?

Craft CMS is a content management system used to build and maintain websites. It provides developers with a structured way to manage digital assets and a GraphQL API, which is a common interface for front-end applications to query and display content dynamically.

What does CVE-2026-124427 mean for security?

This vulnerability is classified as CWE-862, which is an authorization bypass. In the context of this CVE, it means the system fails to correctly verify user permissions when processing GraphQL queries. As a result, anonymous users can access information from content sections that were intended to be private or restricted.

How can an attacker trigger this vulnerability?

An attacker uses the GraphQL interface to make unauthenticated requests. By querying the 'prev' or 'next' fields starting from a publicly visible entry, the attacker can navigate to and read entries from restricted sections. Simply visiting the site or viewing public pages does not trigger the bug; the attacker must intentionally send crafted API queries to crawl and extract data.

Is my Craft CMS instance at risk?

According to Halo Surface Signal, this vulnerability is highly relevant if your GraphQL endpoint is reachable from the internet, which is common for this software. You should assess your risk by checking if your Craft CMS instance is internet-facing and running a version between 5.0.0 and 5.11.2, where this authorization flaw exists.

What should I do to address this issue?

Start by identifying all instances of Craft CMS running the affected version range within your environment. Verify whether the GraphQL API is exposed to the public. If it is, prioritize reviewing those endpoints and plan to update your software to version 5.11.2 or later to apply the necessary authorization controls and close the access path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.