2 matches found
CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
8.8CVSS5.5AI score0.00469EPSS
SaveExploits0References4
CVE-2026-84796: Authorization Bypass Through User-Controlled Key
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
8.8CVSS5.5AI score0.00469EPSS
SaveExploits0References2
20