CVE-2026-123489 Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123489?
CVE-2026-123489 is a high-severity vulnerability in craftcms cms, published on 6 Nov 2026.
Official description
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.
Weakness: CWE-89
Which versions are affected by CVE-2026-123489?
How do I fix CVE-2026-123489?
No fix has been published for CVE-2026-123489 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123489 being exploited?
There is no known exploitation of CVE-2026-123489 in the wild and no public exploit code.
Sources
Also known as GHSA-f6gf-r952-rxg6, GHSA-w2f7-mc8w-f637.