Threats tagged 'ghsa-2rqf-g355-8vxq'

Craft CMS versions from 5.8.17 up to but not including 5.11.2 contain a privilege escalation vulnerability. This flaw arises because the getOwners() function applies caller criteria without properly cleansing the query configuration. As a result, authenticated control panel users can exploit this to invoke attacker-selected static PHP callables, which can promote any account to administrator privileges.