Is CVE-2026-124431 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124431 being exploited in the wild.

How severe is CVE-2026-124431?

Medium severity, with a CVSS score of 4.3, published 8 November 2026.

Is there a fix for CVE-2026-124431?

Yes: fixed in 5.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124431 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124431?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124431: Craft CMS authorization bypass in volume browser

CVE-2026-124431 · Severity: medium · CVSS 4.3 · Published 2026-11-08

Craft CMS is a web content management system used to build and manage websites. A flaw in versions 5.10.0 through 5.11.1 allows authenticated users with limited permissions to view the directory structures of all storage volumes (folders) on the system, even those they should not have access to. While attackers cannot read file contents, this disclosure of directory layouts could aid further attacks or reveal sensitive organizational structure.

Technologies: Craft CMS. Vendors: Craft.

Quick answers

Is CVE-2026-124431 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124431 being exploited in the wild.
How severe is CVE-2026-124431?: Medium severity, with a CVSS score of 4.3, published 8 November 2026.
Which products and versions are affected?: Craft CMS 5.10.0 to 5.11.1.
Is there a fix for CVE-2026-124431?: Yes: fixed in 5.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124431 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124431?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.11.2

Technical details

The vulnerability is a missing authorization check (CWE-862) in the asset replacement modal. When an authenticated user with restricted volume access deletes a linked asset, the replacement volume browser displays all available volumes without verifying permissions. The attack requires user interaction (asset deletion and modal navigation) and affects only the directory structure enumeration, not file access.

Affected products

Craft CMS 5.10.0 to 5.11.1

Timeline

2026-10-23: disclosed: GitHub security advisory published
2026-11-08: advisory: NVD and CVE tracking

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.