CVE-2026-124427: Authorization Bypass in Craft CMS GraphQL

CVE-2026-124427 is an authorization bypass vulnerability in Craft CMS GraphQL affecting versions 5.0.0 before 5.11.2. The flaw allows anonymous, unauthenticated users to access content within sections designated as restricted. The attack exploits prev/next fields in GraphQL queries to enumerate entries and retrieve titles, slugs, and custom field content from sections that should be hidden.

CVSS score 9.8 marks this as critical. The impact is maximum: no authentication required, remote access, and universal attack surface—any caller with knowledge of the GraphQL endpoint can attempt exploitation. NVD published the vulnerability on 2026-11-08. Social media signals on X corroborate the technical details and confirm patch version 5.11.2, though active exploitation in the wild is not yet confirmed.

Security teams must immediately identify all Craft CMS instances in their infrastructure and determine their version. Any instance running a version before 5.11.2 must be updated to 5.11.2 without delay. Review GraphQL access logs for suspicious requests targeting restricted sections. Until patched, consider restricting network access to the GraphQL endpoint or implementing Web Application Firewall rules to block GraphQL introspection and enumeration.