CVE-2026-123490 | Craft CMS up to 5.11.1 Criteria getOwners privileges management

November 6, 2026 Yanac

A vulnerability classified as critical was found in Craft CMS up to 5.11.1. Impacted is the function getOwners of the component Criteria Handler. Such manipulation leads to improper privilege management.

This vulnerability is uniquely identified as CVE-2026-123490. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More