CVE-2026-79991— Authenticated SQL Injection via nested eager-loading criteria
Quick assessment
Affected
craftcms cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Craft CMS 的 GraphQL 入口（entry）变更（mutation）解析器（ 、 ）直接从 中读取 ，而未将其通过 处理。而 正是负责通过 对照 GraphQL 架构中允许站点列表执行站点范围过滤的函数。 查询（query）路径（ ）正确地调用了 ，因此对未授权站点的查询会返回空结果。但变更（mutation）路径完全绕过了这一机制——持有仅授权给站点 A 的令牌的攻击者，只需在变更参数中传入其他站点（如站点 B）的 ，即可在站点 B 中创建、修改或删除条目。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79991
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authenticated SQL Injection via nested eager-loading criteria
Source: CVE Program / CVE List V5
Vulnerability Description
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-79991
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79991
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79991 (1)
Security Blog Posts for CVE-2026-79991 (1)
-
🔗 Authenticated SQL Injection via nested eager-loading criteria | Hackrate third-party-advisory technical-description mitigation
Vendor Pages for CVE-2026-79991 (2)
-
🔗 Release 5.10.13 · craftcms/cms · GitHub release-notes
-
Same Patch Batch · craftcms · 2026-09-02 · 14 CVEs total
| CVE-2026-84795 | 9.8 CRITICAL | Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance |
| CVE-2026-84801 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers |
| CVE-2026-84796 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass |
| CVE-2026-79989 | 8.7 HIGH | Arbitrary user password reset leading to administrator account takeover |
| CVE-2026-79990 | 8.7 HIGH | GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/w |
| CVE-2026-84794 | 7.1 HIGH | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset |
| CVE-2026-84800 | 7.1 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file |
| CVE-2026-84798 | 7.1 HIGH | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite |
| CVE-2026-84797 | 6.3 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate |
| CVE-2026-84793 | 4.8 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name |
| CVE-2026-84792 | 4.3 MEDIUM | Craft CMS before 5.10.11 Broken Access Control via element-indexes |
| CVE-2026-84802 | 4.3 MEDIUM | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController |
| CVE-2026-84799 | 4.3 MEDIUM | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations |
IV. Related Vulnerabilities
Same product: cms
-
CVE-2026-79990
GQL entry mutation `siteId` bypasses schema site scope, enab -
CVE-2026-79989
Arbitrary user password reset leading to administrator accou -
CVE-2026-84801
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via -
CVE-2026-84802
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via As -
CVE-2026-84800
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets
Same vendor: craftcms
-
CVE-2026-79990
GQL entry mutation `siteId` bypasses schema site scope, enab -
CVE-2026-79989
Arbitrary user password reset leading to administrator accou -
CVE-2026-84802
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via As -
CVE-2026-84801
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via -
CVE-2026-84800
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets
Same weakness: CWE-89
-
CVE-2026-81286
WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection v -
CVE-2026-14828
ManageEngine 产品 SQL 注入漏洞 -
CVE-2026-19754
Baserow 2.3.3 - SQL injection in formula index() JSONB array -
CVE-2026-84208
AVideo User_Location Plugin Unauthenticated SQL Injection -
CVE-2026-84153
Xinhu Rainrock RockOA index.php toaddval sql injection
V. Comments for CVE-2026-79991
No comments yet