CVE-2026-90934 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-85617 snipe-it before 8.6.3 Authorization Bypass via Bulk Delete

snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions...

EUVD-2026-57460

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles publish mode...

BIT-SEAWEEDFS-2026-77611 SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler...

CVE-2026-79991 Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

EUVD-2026-70049

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79991 Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79990

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from $arguments without passing through ArgumentManager::prepareArguments(), which normally enforces site-scope filtering. As a result, an attacker with a GraphQL token scoped to one site can create, modify, ...

CVE-2026-79990 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-84796

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-84799 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

EUVD-2026-69908

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-84796

Craft CMS versions from 5.0.0-RC1 through 5.10.10 are affected by a site scope bypass in its GraphQL entry mutation resolvers . The root cause is a failure to validate the siteId argument through ArgumentManager::prepareArguments() , allowing an attacker holding a token scoped to one site to read...

CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

PT-2026-84669

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

PT-2026-84745

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via array intersect against the GraphQL schema’s allowed sites. The query path...