CVE-2026-115938

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.

• CWE-1336

• https://github.com/craftcms/cms
• https://github.com/craftcms/cms/releases/tag/5.11.2
• https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6
• https://www.hckrt.com/hacktivity/HCKRT-DRNL9W

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime th…6.8
• CVE-2026-115931Postiz lets a signed-in user ask the backend to run a functi…9.9
• CVE-2026-115932When a post is published, Postiz treats a media path that is…9.6
• CVE-2026-115933Postiz signs its session, invitation and password reset toke…9.9
• CVE-2026-115935The app/process-api-response-headers action accepts fake Cra…8.8
• CVE-2026-115937The Mollie webhook endpoint accepts two independent, attacke…7.5
• CVE-2026-11594IBM WebSphere Application Server 9.0, and 8.5 is affected by…6.1
• CVE-2026-11595IBM WebSphere Application Server 9.0, and 8.5 could allow a …7.5
• CVE-2026-11596In ScreenConnect™ versions prior to 26.2, input validation w…4.7
• CVE-2026-115969A flaw has been found in Travisun Opptrix 0.4.0. This affect…7.3
• CVE-2026-11597The Surbma | Infusionsoft Shortcode plugin for WordPress is …6.4
• CVE-2026-115970A vulnerability has been found in Travisun Opptrix 0.4.0. Th…7.3