CVE-2026-112776
Deferred Deferred - Pending Action

Authorization Bypass in Craft CMS via GraphQL Token Misuse

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112776
EUVD
EUVD-2026-104582

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms cms 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS versions 5.0.0 to 5.10.0 have a GraphQL authorization bypass flaw. Site-scoped tokens can bypass restrictions and perform actions on other sites. The vulnerability occurs because the system fails to enforce site scope checks during entry creation and deletion mutations. Attackers with a token for site A can create entries in site B by supplying a siteId parameter and delete shared content like entries, categories, tags, and assets across sites.

Detection Guidance

Check Craft CMS version with composer show craftcms/cms. If version is between 5.0.0 and 5.10.x, the system is vulnerable. Review GraphQL mutation logs for unauthorized siteId parameters or cross-site actions.

Impact Analysis

This vulnerability allows unauthorized users to modify or delete content across different sites within a Craft CMS installation. Attackers could inject malicious entries into other sites, delete important shared content, or disrupt site operations. The impact is limited to content manipulation and deletion but does not include data exfiltration or server compromise.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity requirements in GDPR and HIPAA. GDPR requires data integrity and protection against unauthorized alteration, while HIPAA mandates integrity controls for protected health information. Unauthorized content changes may result in compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Craft CMS to version 5.11.0 or later immediately. Review and revoke any site-scoped GraphQL tokens issued before the upgrade. Monitor for unauthorized content modifications or deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart