Executive brief
Craft CMS is a popular content management system used to manage website and application content across multiple sites. A flaw in the GraphQL API allows attackers with restricted access to one site to read, modify, or delete content on other unauthorized sites by directly specifying site IDs in API requests. This could expose confidential content, allow unauthorized changes to published material, or cause service disruption through content deletion.
Technical details
Craft CMS GraphQL entry mutation resolvers (saveEntry and deleteEntry) fail to validate siteId through ArgumentManager::prepareArguments(), which is responsible for enforcing site-scope filtering via array_intersect. While query operations correctly call prepareArguments() to filter unauthorized sites, mutations bypass this validation entirely. An authenticated attacker with a GraphQL token scoped to Site A can pass a siteId parameter in mutation arguments to read, modify, or delete entries in Site B. The vulnerability affects versions 5.0.0-RC1 through 5.10.10; versions 5.10.11 and later include the fix.
Affected products
- Craft CMS CMS 5.0.0-RC1 to 5.10.10
Timeline
- 2026-08-18: disclosed: GitHub Security Advisory GHSA-3wcr-p33w-528f published
- 2026-09-02: advisory: CVE-2026-84796 published
- 2026-08-18: patched: Patch available in version 5.10.11