CVE-2026-124426

Craft CMS versions 5.0.0 before 5.11.2 are vulnerable to an authorization bypass (CWE-862) within the GraphQL API. Unauthenticated attackers can exploit this by sending a POST request to /actions/graphql/api while selecting a localized field without providing the siteId argument. This flaw allows...