Executive brief
Craft CMS, a popular content management system, contains a security flaw in its GraphQL API. An attacker with limited access to the system can bypass security restrictions to view the personal addresses, full names, and tax IDs of every user in the database. This could lead to the exposure of sensitive private information for customers and administrators alike, potentially resulting in privacy law violations and reputational damage.
Technical details
The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) in Craft CMS fails to implement schema scope filtering via GqlHelper::extractAllowedEntitiesFromSchema() for top-level queries. While other resolvers (Entries, Users, etc.) correctly enforce scope boundaries, the Address resolver only performs a binary check (canQueryUsers). Consequently, a GraphQL API token scoped to a specific low-privilege user group can query and retrieve addresses belonging to any user group in the system. This allows for unauthorized access to PII including full names, physical addresses, organizations, and tax IDs. The vulnerability is fixed in versions 4.17.12 and 5.9.18.
Affected products
- Pixel & Tonic Craft CMS 4.0.0 to 4.17.11, 5.0.0 to 5.9.17
Timeline
- 2026-04-27: advisory: Original GitHub Security Advisory published
- 2026-05-12: disclosed: CVE-2026-44010 published to NVD
- 2026-05-12: patched: Fixes released in versions 4.17.12 and 5.9.18