Authenticated SQL Injection via nested eager-loading criteria

A non-admin, low-privileged Control Panel user (whose permission set is limited to the single baseline permission accessCp) can perform blind SQL injection against the element-index endpoint (element-indexes/get-elements and siblings), gaining arbitrary read access to the database.

This breaks Craft’s own privilege-separation model: a confined “editor/author” account (which is normally restricted to a handful of sections/fields) escalates to full database read access, which in practice is equivalent to admin-level information disclosure and serves as a stepping stone to full account takeover.

Precondition: Craft 5.10.12, Team or Pro edition (multi-user support), at least one existing non-admin account with the baseline accessCp permission, and at least one entry with an author. No non-default configuration is required.

This vulnerability allows any low-privileged authenticated Control Panel user to read the application database via blind SQL injection.