CVE-2026-123491 | Craft CMS up to 4.18.8/5.11.1 GraphQL sql injection

A vulnerability labeled as critical has been found in Craft CMS up to 4.18.8/5.11.1. The impacted element is an unknown function of the component GraphQL. Such manipulation leads to sql injection.

This vulnerability is documented as CVE-2026-123491. The attack can be executed remotely. There is not any exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More