Improperly Controlled Modification of Dynamically-Determined Object Attributes in Craft CMS - #VU159594
Published: November 6, 2026
Vulnerability identifier: #VU159594
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-915
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated control panel user to gain administrator privileges in Craft CMS and promote every other account.
The vulnerability exists due to unsanitized query configuration accepted by getOwners() when invoked through sandboxed Twig templates in the relational-condition object template feature. An authenticated control panel user can submit a crafted template and nested reference element to invoke a PHP callable that grants administrator status to all accounts, including their own.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - update to 5.11.2