CVE-2026-112776
CVE-2026-112776 · Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
CVSS 9.3 · Critical · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
cms
- Versions
- ≥ 5.0.0, < 5.11.0: Affected (semver)
- 5.11.0: Not affected (semver)
Update to 5.11.0