Craft CMS 8-CVE patch batch — the one to prioritise:
CVE-2026-112776 (9.8): unauthenticated GraphQL site-scope bypass. Cross-site data access on multi-tenant installs with no credentials.
Plus five Twig sandbox escapes and a verification-code ATO flaw that chains into them.
Craft 5.x → 5.11.0 | Craft 4.x → 4.18.8
https://threataft.com/articles/craft-cms-cve-2026-112776-graphql-twig-sandbox-rce
ThreatAftCraft CMS 9.8 GraphQL Bypass + 7 Twig RCEs | ThreatAftCraft CMS 5.x/4.x: 8 CVEs incl. 9.8 GraphQL site-scope bypass and five Twig sandbox RCEs. Fixed in 5.11.0 / 4.18.8.