CVE-2026-28696: Craft affected by IDOR via GraphQL @parseRefs

The GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view.

Vulnerability Details

craft\services\Elements::parseRefs identifies reference tags and resolves them using getRefTokenReplacement. This method fetches the referenced element and accesses the specified attribute via $element->$attribute.

- Missing Auth Check: It bypasses canView() checks. - Polymorphic Access: getElementTypeByRefHandle allows referencing any element type (entry, asset, user, category). - Custom Field Access: Since Craft elements use get() to resolve custom field handles, an attacker is not limited to core attributes. They can exfiltrate any custom field data by enumerating the field handle (e.g. {entry:123:privateNotes}).

Attack Vectors

1. Privilege Escalation / User Data Leak

An attacker can enumerate sensitive attributes of administrators or other users.

- Payload: {user:1:email} or {user:1:photoId}

2. Arbitrary Property Reflection & Server-Side Logic Execution

The vulnerability allows reflecting any accessible property of the underlying Element model.

- Username/Admin Enumeration: {user:1:username} (Confirmed: returns admin), {user:1:admin}. - Internal Path Disclosure: Accessing methods that trigger errors (e.g., {user:1:authKey}) exposes full server stack traces in the GraphQL error response (e.g., Exception: No user session token exists with paths like /var/www/html/...).

3. IDOR on Private Entries & Assets (Polymorphism)

The vulnerability is not limited to Users. Reference tags can target any element type.

- Payload: {entry:456:myConfidentialField} (Bypasses canView checks). - Asset Path Leakage: {volume:1:path} can expose internal file system paths.

4. Unauthenticated Exploitation (Public Schema)

Confirmed locally. The @parseRefs directive is active in the Public Schema. By injecting a payload into a public-facing field (e.g., a "News" entry title), an unauthenticated guest can trigger the resolution and retrieve the sensitive output.

Steps to Reproduce

1. Setup (Admin Panel): - Create a Section (e.g., "News") and an Entry Type. - Create a new Entry in that section. Set the Title to the payload: {user:1:username} or {user:1:email}. - Go to GraphQL > Schemas > Public Schema. Enable it, and ensure "Query for elements in the Site" and "News" section queries are checked.

2. Execute Exploit (Unauthenticated): - Send a POST request to http://localhost:8000/index.php?action=graphql/api: curl -X POST \ -H "Content-Type: application/json" \ -d '{"query": "{ entries { title @parseRefs } }"}'

3. Observation: - The API returns {"data":{"entries":[{"title":"admin"}]}} (or the email). - Using {user:1:authKey} triggers an internal server error that leaks the full server path in string format.

Impact

- Critical Information Disclosure: Full PII enumeration (emails, usernames). - System Information Leakage: Absolute server paths via stack traces. - Authentication Bypass: Guest accounts can effectively query the database as the system user.

Recommended Fix

Modify Elements::parseRefs to enforce canView permissions on the resolved element before extracting attributes.

References

https://github.com/craftcms/cms/commit/4d98a07e47580f1712095825d3e3c4d67bc9f8b9

— GitHub