CVE-2026-92594: Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
craftcmsto a version that resolves this vulnerability.Fixed in 5.11.0
Event History
Frequently Asked Questions
Which deployments are exposed without authentication?
Deployments are exposed without authentication only if the public GraphQL schema is enabled and grants the elements.drafts:read or elements.revisions:read scope. In that configuration, an unauthenticated client can query creator data for drafts or revisions.
What information can an attacker retrieve?
The affected resolvers can expose the email address, username, full name, and postal addresses of users who created drafts or revisions. These users will typically include site editors and administrators.
What access is required if the GraphQL schema is not public?
A client needs GraphQL access with either the elements.drafts:read or elements.revisions:read scope. The user-data scope checked by Gql::canQueryUsers(), including usergroups.*:read, is not required for the affected fields.
What can be done before upgrading?
Do not expose a public GraphQL schema with elements.drafts:read or elements.revisions:read scopes. Restrict those scopes to clients that require them until Craft CMS can be updated to 5.11.0.