EUVD-2026-119574

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId...

CVE-2026-124426

Craft CMS versions 5.0.0 before 5.11.2 are vulnerable to an authorization bypass (CWE-862) within the GraphQL API. Unauthenticated attackers can exploit this by sending a POST request to /actions/graphql/api while selecting a localized field without providing the siteId argument. This flaw allows...

CVE-2026-124426: craftcms cms: Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers…

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId...