CVE-2026-79990— GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Quick assessment
Affected
craftcms cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Craft CMS 中 GraphQL 的条目（entry）变更操作解析器（ 、 ）直接从 中读取 ，而没有经过 的 方法。该方法本应通过 对 GraphQL 架构中允许访问的网站进行站点作用域过滤。 查询路径（ ）正确地调用了 ，因此针对未授权网站的查询会返回空结果。然而，变更操作（mutations）完全绕过了这一机制——一个仅拥有网站 A 作用域令牌的攻击者，可以通过在变更操作的参数中传入 来在网站 B 中创建、修改或删除条目。
Possible ATT&CK Techniques 3 AI
T1598.002 · Spearphishing Attachment T1079 T1578.002 · Create Cloud Instance
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79990
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Source: CVE Program / CVE List V5
Vulnerability Description
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-79990
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79990
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79990 (1)
Security Blog Posts for CVE-2026-79990 (1)
-
🔗 GQL entry mutation siteId bypasses schema site scope | Hackrate third-party-advisory technical-description mitigation
Vendor Pages for CVE-2026-79990 (2)
-
🔗 Release 5.10.11 · craftcms/cms · GitHub release-notes
-
Same Patch Batch · craftcms · 2026-09-02 · 14 CVEs total
| CVE-2026-84795 | 9.8 CRITICAL | Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance |
| CVE-2026-84801 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers |
| CVE-2026-84796 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass |
| CVE-2026-79989 | 8.7 HIGH | Arbitrary user password reset leading to administrator account takeover |
| CVE-2026-84794 | 7.1 HIGH | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset |
| CVE-2026-84800 | 7.1 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file |
| CVE-2026-84798 | 7.1 HIGH | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite |
| CVE-2026-79991 | 7.1 HIGH | Authenticated SQL Injection via nested eager-loading criteria |
| CVE-2026-84797 | 6.3 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate |
| CVE-2026-84793 | 4.8 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name |
| CVE-2026-84792 | 4.3 MEDIUM | Craft CMS before 5.10.11 Broken Access Control via element-indexes |
| CVE-2026-84802 | 4.3 MEDIUM | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController |
| CVE-2026-84799 | 4.3 MEDIUM | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations |
IV. Related Vulnerabilities
Same product: cms
-
CVE-2026-79991
Authenticated SQL Injection via nested eager-loading criteri -
CVE-2026-79989
Arbitrary user password reset leading to administrator accou -
CVE-2026-84801
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via -
CVE-2026-84802
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via As -
CVE-2026-84800
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets
Same vendor: craftcms
-
CVE-2026-79991
Authenticated SQL Injection via nested eager-loading criteri -
CVE-2026-79989
Arbitrary user password reset leading to administrator accou -
CVE-2026-84802
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via As -
CVE-2026-84801
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via -
CVE-2026-84800
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets
Same weakness: CWE-639
-
CVE-2026-84771
WordPress PublishPress Permissions plugin <= 4.8.3 - Insecur -
CVE-2026-84796
Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Si -
CVE-2026-82968
Keycloak-services: keycloak-services: cross-session email ve -
CVE-2026-81846
runZero MCP 'Findings summaries' Data Leak -
CVE-2026-84205
GROWI through 8.0.2 Authorization Bypass Through User-Contro
V. Comments for CVE-2026-79990
No comments yet