Executive brief
Craft CMS is a content management system used to build and manage websites. Versions 5.0.0-RC1 through 5.10.x contain a flaw in the GraphQL API that allows unauthenticated users or clients with limited permissions to access sensitive employee data—including email addresses, usernames, full names, and postal addresses—of site editors and administrators. This represents a significant privacy breach when the GraphQL schema is configured to allow public access.
Technical details
The vulnerability is a scope-isolation failure (CWE-200) in the GraphQL API's authorization logic. The draftCreator and revisionCreator fields are incorrectly gated on the elements.drafts:read and elements.revisions:read scopes instead of the stricter usergroups.*:read scope required for all other User object queries. The User resolver returns raw User elements with email, username, fullName, and addresses fields that lack per-field authorization checks. An unauthenticated client or any token-scoped to drafts/revisions (but not user-data) can query these fields to harvest PII of all draft and revision creators. The attack requires network access to the GraphQL endpoint and is reachable without authentication if the public schema is configured with drafts or revisions scopes. A fix is available in version 5.11.0.
Affected products
- Craft CMS 5.0.0-RC1 through 5.10.x
Timeline
- 2026-09-01: disclosed
- 2026-09-16: advisory
- 2026-09-16: patched: Fixed in version 5.11.0