GHSA-mp59-9rf5-93wr: Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

Q: Which deployments are exposed to this issue?

Craft CMS versions from 5.0.0 before 5.11.2 are affected where the GraphQL API endpoint at /actions/graphql/api is reachable. The issue concerns GraphQL schemas that use a Sites scope intended to restrict content by site.

Q: What does an attacker need to exploit it?

No authentication, privileges, or user interaction are required. An attacker can send a POST request to /actions/graphql/api that selects the localized field without supplying the siteId argument.

Q: What information can be exposed?

The bypass allows reading content belonging to sites outside the GraphQL schema's configured Sites scope. The provided impact information indicates confidentiality impact only; integrity and availability impacts are not identified.

Q: How can I tell whether my instance is affected?

Check whether the Craft CMS version is 5.0.0 through a version earlier than 5.11.2, and whether GraphQL is exposed at /actions/graphql/api. Affected behavior can be assessed by determining whether a query using localized without siteId returns content from a site excluded by the schema's Sites scope.

Published Nov 8, 2026

Updated

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

Affected Software

1 affected component

Craft CMS Craft CMS>=5.0.0<5.11.2

Event History

Nov 8, 2026

CVE Published

via OSV·01:15 PM

Data Sourced

via OSV·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Craft CMS versions from 5.0.0 before 5.11.2 are affected where the GraphQL API endpoint at /actions/graphql/api is reachable. The issue concerns GraphQL schemas that use a Sites scope intended to restrict content by site.

What does an attacker need to exploit it?

No authentication, privileges, or user interaction are required. An attacker can send a POST request to /actions/graphql/api that selects the localized field without supplying the siteId argument.

What information can be exposed?

The bypass allows reading content belonging to sites outside the GraphQL schema's configured Sites scope. The provided impact information indicates confidentiality impact only; integrity and availability impacts are not identified.

How can I tell whether my instance is affected?

Check whether the Craft CMS version is 5.0.0 through a version earlier than 5.11.2, and whether GraphQL is exposed at /actions/graphql/api. Affected behavior can be assessed by determining whether a query using localized without siteId returns content from a site excluded by the schema's Sites scope.

GHSA-mp59-9rf5-93wr: Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information can be exposed?

How can I tell whether my instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information can be exposed?

How can I tell whether my instance is affected?