CVE-2026-79990— GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Quick assessment
Affected
craftcms cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Craft CMS是Craft CMS公司的一套内容管理系统(CMS)。 Craft CMS 5.0.0-RC1至5.10.11之前版本存在授权问题漏洞，该漏洞源于GraphQL条目变更解析器直接读取siteId参数而未经过prepareArguments()函数执行站点范围过滤，可能导致具有站点A令牌的攻击者通过传递siteId参数在站点B创建、修改或删除条目。
Possible ATT&CK Techniques 3 AI
T1598.002 · Spearphishing Attachment T1079 T1578.002 · Create Cloud Instance
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79990
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Source: CVE Program / CVE List V5
Vulnerability Description
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Craft CMS 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Craft CMS是Craft CMS公司的一套内容管理系统(CMS)。 Craft CMS 5.0.0-RC1至5.10.11之前版本存在授权问题漏洞，该漏洞源于GraphQL条目变更解析器直接读取siteId参数而未经过prepareArguments()函数执行站点范围过滤，可能导致具有站点A令牌的攻击者通过传递siteId参数在站点B创建、修改或删除条目。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-79990
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79990
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79990 (1)
Security Blog Posts for CVE-2026-79990 (1)
-
🔗 GQL entry mutation siteId bypasses schema site scope | Hackrate third-party-advisory technical-description mitigation
Vendor Pages for CVE-2026-79990 (2)
-
🔗 Release 5.10.11 · craftcms/cms · GitHub release-notes
-
Same Patch Batch · craftcms · 2026-09-02 · 14 CVEs total
| CVE-2026-84795 | 9.8 CRITICAL | Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance |
| CVE-2026-84801 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers |
| CVE-2026-84796 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass |
| CVE-2026-79989 | 8.7 HIGH | Arbitrary user password reset leading to administrator account takeover |
| CVE-2026-84794 | 7.1 HIGH | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset |
| CVE-2026-84800 | 7.1 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file |
| CVE-2026-84798 | 7.1 HIGH | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite |
| CVE-2026-79991 | 7.1 HIGH | Authenticated SQL Injection via nested eager-loading criteria |
| CVE-2026-84797 | 6.3 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate |
| CVE-2026-84793 | 4.8 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name |
| CVE-2026-84792 | 4.3 MEDIUM | Craft CMS before 5.10.11 Broken Access Control via element-indexes |
| CVE-2026-84802 | 4.3 MEDIUM | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController |
| CVE-2026-84799 | 4.3 MEDIUM | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations |
IV. Related Vulnerabilities
Same product: cms
-
CVE-2026-115938
Low privilege condition filter escapes Twig sandbox, recover -
CVE-2026-115935
Control panel only API response emulation replaces "security -
CVE-2026-113358
LavaLite CMS through 10.1.2 Missing Authentication via Filer -
CVE-2026-112777
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist B -
CVE-2026-112776
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via
Same vendor: craftcms
-
CVE-2026-115938
Low privilege condition filter escapes Twig sandbox, recover -
CVE-2026-115937
Unauthenticated payment reuse allows unpaid orders to be mar -
CVE-2026-115935
Control panel only API response emulation replaces "security -
CVE-2026-112777
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist B -
CVE-2026-112776
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via
Same weakness: CWE-639
-
CVE-2026-116018
ONEARMY community-platform before 2.165.2 IDOR via notificat -
CVE-2026-116017
Xiaozhi-esp32-server before 0.9.8 IDOR via device address-bo -
CVE-2026-116015
yudao-cloud through 2026.09 IDOR via after-sale-log list end -
CVE-2026-116010
RosarioSIS before 12.9.1 Missing Authorization in Teacher Sa -
CVE-2026-115998
IDOR: User reads and modifies findings from other people's p
V. Comments for CVE-2026-79990
No comments yet