CVE-2026-112776: Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Craft CMS versions from 5.0.0 before 5.11.0 are affected. The issue applies where site-scoped GraphQL tokens can be used for mutations.
What does an attacker need to exploit this?
An attacker needs a GraphQL token scoped to one site, such as site A. They can supply another site’s siteId to create content there and can delete entries, categories, tags, and assets shared across sites.
Is authentication required?
Yes. Exploitation requires possession of a site-scoped GraphQL token, but does not require a token authorized for the target site.
How can I determine whether I may be exposed?
Check whether the installation runs Craft CMS 5.0.0 through a version earlier than 5.11.0 and issues site-scoped GraphQL tokens with mutation capability. Review GraphQL mutation activity for requests using site IDs outside the token’s intended site scope.