CVE-2026-84796: Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11
Event History
Frequently Asked Questions
Who is exposed to this issue?
Craft CMS deployments running a version before 5.10.11 are affected if GraphQL entry mutations can be performed with tokens scoped to a site. An attacker must possess a token scoped to one site; the issue enables access to entries on other sites.
What does an attacker need to do to exploit it?
The attacker needs a GraphQL token with permissions scoped to at least one site. They can pass a siteId directly in entry mutation arguments to target entries in unauthorized sites.
What is the potential impact?
An attacker can read, modify, or delete entries across sites outside the scope of their token. The reported impact includes confidentiality, integrity, and availability effects.
How can I remediate the issue?
Upgrade Craft CMS to version 5.10.11 or later. The affected range is described as versions before 5.10.11.