Executive brief
Craft CMS is a popular PHP-based content management system. A flaw in its GraphQL API allows users with restricted access to one website to create, modify, or delete content on other websites by supplying an unauthorized site ID parameter in mutation requests, bypassing the platform's intended multi-site access controls.
Technical details
The vulnerability exists in Craft CMS's GraphQL mutation resolvers for saveEntry and deleteEntry operations. These resolvers read the siteId parameter directly from user-supplied arguments without passing them through the ArgumentManager's prepareArguments() function, which enforces site-scope filtering via array_intersect() against the schema's allowed sites. In contrast, GraphQL queries (via ElementResolver) correctly call prepareArguments(), preventing unauthorized site access. An attacker holding a GraphQL token scoped to Site A can bypass this filtering to create, modify, or delete entries in Site B by including the target siteId in the mutation arguments. A patch enforcing prepareArguments() validation for mutations is needed.
Affected products
- Craft CMS CMS <UNKNOWN>
Timeline
- 2026-09-02: disclosed