CVE-2026-79990
Received Received - Intake

Craft CMS GraphQL Entry Mutation Site ID Authorization Bypass

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Hackrate

Description
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-79990
EUVD
EUVD-2026-70048

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
craftcms craft_cms *
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.11 (exc)
craftcms craft_cms 5.10.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Craft CMS allows attackers with a token scoped to one site to bypass site-scope restrictions in GraphQL entry mutations. The saveEntry and deleteEntry resolvers read siteId directly from user input without validating against allowed sites, enabling unauthorized access to other sites.

Impact Analysis

An attacker could read confidential content, modify or delete entries across sites, or disrupt site operations. This includes unauthorized data exposure, data integrity corruption, and potential service disruption due to content deletion.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's confidentiality requirements. It may result in non-compliance penalties, reputational damage, and legal consequences due to compromised sensitive data.

Mitigation Strategies

Immediately update Craft CMS to version 5.10.11 or later to patch the vulnerability. Review GraphQL mutation logs for unauthorized siteId parameters in saveEntry and deleteEntry operations. Restrict GraphQL API access to trusted users and monitor for unusual cross-site data access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79990. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart