CVE-2026-112776GHSA-7RR3-4JCM-X526
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 5.11.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
Affected versions
- craftcms cms
From 5.0.0 · fixed in 5.11.0