CVE-2026-79990

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from $arguments without passing through ArgumentManager::prepareArguments(), which normally enforces site-scope filtering. As a result, an attacker with a GraphQL token scoped to one site can create, modify, ...