CVE-2026-84796
Received Received - Intake

Craft CMS Site Scope Bypass via GraphQL Entry Mutation

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84796
EUVD
EUVD-2026-69908

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84796 is a site scope bypass vulnerability in Craft CMS versions before 5.10.11. It affects GraphQL entry mutation resolvers like saveEntry and deleteEntry. These resolvers fail to validate the siteId parameter through ArgumentManager::prepareArguments(), which normally enforces site-scope restrictions. Attackers with a token scoped to one site can manipulate the siteId in mutation arguments to access, modify, or delete entries on other unauthorized sites.

Detection Guidance

To detect this vulnerability, check Craft CMS versions before 5.10.11. Run the command: composer show craftcms/cms to verify the installed version. If the version is below 5.10.11, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to bypass site isolation. They can read sensitive data from other sites, alter or delete content across sites, and potentially escalate privileges. The impact includes confidentiality breaches, data integrity risks, and service disruptions due to unauthorized deletions.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to protected data. GDPR requires strict data access controls and breach notification; HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade Craft CMS to version 5.10.11 or later. Review GraphQL mutation logs for suspicious siteId parameter usage across sites. Revoke and regenerate all GraphQL tokens to prevent potential misuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84796. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart