Craft CMS versions 5.8.17 through 5.11.1 allow an authenticated control panel user to elevate privileges by exploiting the getOwners() function. The function applies caller criteria directly to the query configuration without cleaning it, enabling the attacker to trigger static PHP callables. As a result, every user account can be promoted to administrator status, compromising the entire site’s security.

The vulnerability affects the Craft CMS product from the craftcms vendor. All installations running Craft CMS prior to version 5.11.2 are impacted.

The CVSS score of 8.7 indicates high severity, but the EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability can be triggered by any authenticated user with control panel access, meaning that an attacker who already gains login credentials can perform a privilege escalation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation at this time.