CVE-2026-124430

Craft CMS versions 5.10.0 before 5.11.2 are vulnerable to Remote Code Execution (RCE) . The issue stems from an HMAC-signed Twig template signing oracle at the app/render-elements endpoint, which allows non-administrator control panel users to obtain signed templates. An attacker can submit the s...