Description
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.8.17 – < 5.11.2 | 5.11.2 |
References
- GitHub Security Advisory (GHSA-r56r-f696-c8w9) vendor-advisory
- VulnCheck Advisory: Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass third-party-advisory