CVE-2026-112776

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776

Craft CMS versions 5.0.0 through 5.11.0 are vulnerable to a GraphQL Site-Scope Bypass via mutations. The root cause is the failure to enforce the requireAllowedSite() function, allowing site-scoped GraphQL tokens to interact with content from other sites. An attacker holding a valid token for one...

EUVD-2026-104582

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...