Description

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-06T15:17:18.483Z",
  "pubdate": "2026-11-06T15:17:18.483Z",
  "executiveSummary": "Craft CMS versions 5.8.17 through 5.11.1 contain a critical privilege escalation vulnerability rooted in improper input sanitization within the query configuration logic.\nThe vulnerability originates from the getOwners() function, which fails to validate or sanitize user-supplied caller criteria before processing query parameters.\nAn authenticated user with access to the control panel can exploit this oversight to execute attacker-selected static PHP callables.\nSuccessful exploitation permits a malicious actor to elevate their account privileges to administrator, granting full control over the CMS instance.\nThis vulnerability represents a high risk as it bypasses authorization controls, allowing low-privileged authenticated users to gain complete administrative access to the platform.\nThe primary requirement for exploitation is a valid control panel session, making this an internal threat or a targeted attack against authenticated users.",
  "technicalDetails": "The vulnerability resides within the query processing logic of Craft CMS, specifically involving the getOwners() method. This function is responsible for retrieving entity relationships but fails to implement adequate cleansing of query criteria provided by the caller.\nIn the vulnerable versions, the application passes user-supplied criteria directly into the query execution flow without applying necessary allow-listing or type enforcement. Because the input processing logic treats these criteria as trusted configuration, it inadvertently allows the injection of arbitrary static PHP callables.\nExploitation proceeds by an authenticated control panel user crafting a malicious request that manipulates the criteria parameters passed to getOwners(). By injecting a static PHP callable into the query configuration, the attacker forces the application to execute arbitrary code during the query building or execution phase.\nThe critical impact of this injection is the ability to bypass standard permission checks and invoke functions designed for administrative operations. Specifically, the attacker can execute logic that modifies the user entity's permission set, promoting the currently authenticated account to the administrator group.\nThe attack flow is as follows: 1) The attacker initiates a request to a component utilizing getOwners(); 2) The attacker injects a malicious payload into the criteria configuration parameters; 3) The application deserializes or processes the unsanitized input; 4) The getOwners() method executes the injected static PHP callable; 5) The resulting execution triggers a privilege elevation operation on the user record; 6) The attacker's session is upgraded to administrative level, granting full control over the system.\nThis vulnerability affects versions 5.8.17 up to, but not including, 5.11.2. Because it requires authenticated access to the control panel, it is restricted to scenarios where an attacker already possesses at least a standard authenticated user role. However, the subsequent impact—total system compromise—makes this a high-severity flaw in multi-user environments where user roles are strictly defined."
}