10702 matches found
CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
EUVD-2026-70048
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-79990
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from $arguments without passing through ArgumentManager::prepareArguments(), which normally enforces site-scope filtering. As a result, an attacker with a GraphQL token scoped to one site can create, modify, ...
CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...
CVE-2026-18924
creationtimestamp| type| source ---|---|--- 2026-09-02 12:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mujx3y4rb22k 2026-09-08 16:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muzfvusbze2b 2026-09-08 20:03:22+00:00| seen|...
CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...
CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...
CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...
CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
CVE-2026-84792
Craft CMS versions before 5.10.11 are affected by a broken access control vulnerability in the element-indexes/save-elements endpoint. An attacker with control panel access and limited section permissions can overwrite the sectionId attribute after the initial authorization check, bypassing the d...
CVE-2026-78141
creationtimestamp| type| source ---|---|--- 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9751b736-8bb9-4c37-8b98-397276c88a36 2026-09-03 01:02:36+00:00| exploited|...
ECHO-F292-4A07-579C
Bulletin has no description...
MINI-FHRM-7VC7-263F
Bulletin has no description...
CVE-2026-82918
creationtimestamp| type| source ---|---|--- 2026-09-02 04:48:54+00:00| seen| https://jvn.jp/en/vu/JVNVU98062224...
CVE-2026-84310
creationtimestamp| type| source ---|---|--- 2026-09-02 03:31:51+00:00| seen| https://gist.github.com/alon710/3521e58613b990dddef5bf0335b08c88...
CVE-2026-84351
creationtimestamp| type| source ---|---|--- 2026-09-02 00:40:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117198658318645016 2026-09-02 04:47:04+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260902 2026-09-04 04:45:26+00:00| seen|...
PT-2026-84745
Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via array intersect against the GraphQL schema’s allowed sites. The query path...
CVE-2023-40288
creationtimestamp| type| source ---|---|--- 2026-09-01 20:00:46+00:00| seen| https://t.me/hackingAttack/121668 2026-09-02 01:01:06+00:00| seen| https://t.me/hackingAttack/121668 2026-09-04 03:00:03+00:00| seen| https://t.me/hackingAttack/121668 2026-09-05 01:00:42+00:00| seen|...