CVE-2026-92591

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on already-installed production sites whenever PHP is still serving requests but the configured MySQL endpoint is unreachable. The installer accepts a site name that is serialized through Site::getName() and expanded via App::env(), so an unauthenticated attacker can submit a predictable variable name such as CRAFT_SECURITY_KEY and receive its value. A successful attempt discloses Craft secrets, process environment variables, $_SERVER entries, or PHP constants, potentially including the application security key, database credentials, or API keys. Exploitation requires an independently occurring database outage plus a guest session cookie and matching CSRF token obtained beforehand and still valid during the outage, so every Craft 5.x site running 5.0.0–5.10.12 carries the flaw but only those hit by an outage in such a window are concretely exposed. There is no public proof-of-concept, no known in-the-wild exploitation, and the issue is not listed in CISA KEV; it is fixed in 5.10.13.

What to do: Upgrade to Craft CMS 5.10.13 or later. Where immediate upgrade is not possible, treat any database outage as a security window: invalidate guest sessions and rotate CSRF state after outages, and block unauthenticated access to installer actions such as install/validate-site at the web server or application firewall. After any outage, review access logs for requests to installer endpoints and rotate the security key and any database or API credentials that could have been exposed.