CVE-2026-124426: Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.
Event History
Frequently Asked Questions
Which deployments are exposed?
Craft CMS versions from 5.0.0 before 5.11.2 are affected where a GraphQL schema uses a Sites scope. Content from sites outside that configured scope may be readable through the GraphQL API.
What does an attacker need to exploit this issue?
No authentication, privileges, or user interaction are required. An attacker can send a POST request to /actions/graphql/api that selects the localized field without supplying the siteId argument.
What content can be disclosed?
The issue exposes content belonging to sites outside the GraphQL schema's configured Sites scope. The available data describes confidentiality impact only; it does not indicate integrity or availability impact.
How can I determine whether my instance is vulnerable?
Check whether the Craft CMS version is 5.0.0 through a version earlier than 5.11.2, and whether GraphQL schemas use Sites scope restrictions. Affected instances may return out-of-scope site content for a request to /actions/graphql/api that selects localized without siteId.