# CVE-2026-92594: Craft CMS GraphQL authorization bypass in draftCreator and revisionCreator fields

Source: https://junglewise.ai/threats/cve-2026-92594-craft-cms-graphql-authorization-bypass-in-draftcreator-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92594 · Severity: high · CVSS 7.5 · Published 2026-09-16

Craft CMS is a content management system used to build and manage websites. Versions 5.0.0-RC1 through 5.10.x contain a flaw in the GraphQL API that allows unauthenticated users or clients with limited permissions to access sensitive employee data—including email addresses, usernames, full names, and postal addresses—of site editors and administrators. This represents a significant privacy breach when the GraphQL schema is configured to allow public access.

## Quick answers

**Is CVE-2026-92594 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92594 being exploited in the wild.

**How severe is CVE-2026-92594?** High severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** Craft CMS 5.0.0-RC1 through 5.10.x.

**Is there a fix for CVE-2026-92594?** A patch was published on 2026-09-16: Fixed in version 5.11.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92594 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92594?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a scope-isolation failure (CWE-200) in the GraphQL API's authorization logic. The draftCreator and revisionCreator fields are incorrectly gated on the elements.drafts:read and elements.revisions:read scopes instead of the stricter usergroups.*:read scope required for all other User object queries. The User resolver returns raw User elements with email, username, fullName, and addresses fields that lack per-field authorization checks. An unauthenticated client or any token-scoped to drafts/revisions (but not user-data) can query these fields to harvest PII of all draft and revision creators. The attack requires network access to the GraphQL endpoint and is reachable without authentication if the public schema is configured with drafts or revisions scopes. A fix is available in version 5.11.0.

## Affected products

- Craft CMS 5.0.0-RC1 through 5.10.x

## Timeline

- 2026-09-01: disclosed
- 2026-09-16: advisory
- 2026-09-16: patched: Fixed in version 5.11.0

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-pcmv-c398-gc5m](https://github.com/craftcms/cms/security/advisories/GHSA-pcmv-c398-gc5m)
- [https://www.vulncheck.com/advisories/craft-cms-before-5.11.0-unauthenticated-pii-disclosure-via-graphql](https://www.vulncheck.com/advisories/craft-cms-before-5.11.0-unauthenticated-pii-disclosure-via-graphql)