CVE-2026-84799: Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Craft CMS deployments before 5.11.0 that expose native GraphQL user relations and issue scoped GraphQL tokens are affected. The issue can expose information about any content author or uploader, including administrators.
What does an attacker need to exploit it?
An attacker needs a scoped GraphQL token. No user interaction is required, and the attacker can use native user-relation fields such as author, authors, uploader, draftCreator, and revisionCreator.
What information can be disclosed?
The affected relations can disclose usernames, email addresses, and full names for content authors or uploaders. The impact is limited to confidentiality; no integrity or availability impact is stated.
How can I determine whether my instance is affected?
Check whether the Craft CMS version is earlier than 5.11.0 and whether scoped GraphQL tokens can query native user-relation fields. Affected behavior allows those queries to return user details outside the token's intended user-group scope.