Craft CMS GraphQL Address Resolver Missing Authorization PII Disclosure (CVE-2025-44010)

Vulnerability Summary: Craft CMS GraphQL Address Resolver Missing Authorization Leads to PII Disclosure Vulnerability Overview Title: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure CVE ID: CVE-2025-44010 Severity: Moderate Published: 3 weeks ago Affected Software: craftcms/cms (Composer) Description: The GraphQL address element resolver ( ) in Craft CMS fails to apply schema scope filtering for top-level queries. This means that even if a GraphQL API Token is restricted to access only a single low-privilege user group, an attacker can still read all addresses in the system, including sensitive personally identifiable information (PII) belonging to other user groups (such as internal executives), such as full names, addresses, organizations, tax IDs, etc. Technical Details: Other GraphQL element resolvers apply scope filtering during queries via , except for the address resolver. The only check performed is , which only conducts a binary check (whether there is permission to access any user group). Once passed, no further filtering is applied. Impact Scope Affected Versions: > 5.0.0, = 4.0.0, < 4.17.12 Affected Environments: Websites using Craft CMS Pro version (v4.0+). Websites using GraphQL API Tokens and storing user addresses. Headless CMS deployments (e.g., using frameworks like Next.js, Nuxt.js, Gatsby). Risks: Data Breach: Any GraphQL API Token with access to a single user group can extract all address data within the system (including names, home addresses, organizations, tax IDs). Targeted Extraction (IDOR): By exploiting the parameter, an attacker can extract addresses of specific internal users without brute-forcing or escalating privileges. Scope Boundary Failure: Undermines the primary security mechanism Craft CMS uses to control API access. Remediation Upgrade Versions: Craft CMS 5.x users should upgrade to 5.9.18 or higher. Craft CMS 4.x users should upgrade to 4.17.12 or higher. POC Code and Exploitation Steps Environment Setup: Two user groups: (within token scope) and (outside scope). 5 internal executives (with company addresses) and 3 public customers (with personal addresses). GraphQL Token has read permissions only for the group. Step 1: Probe Schema Step 2: Enumerate Address Fields Step 3: Establish Baseline (Confirm User Scope Restriction) Step 4: Query All Addresses (Unauthorized Access) Step 5: Targeted IDOR Extraction of Specific Internal User Addresses**

Goal Reached Thanks to every supporter — we hit 100%!

Craft CMS GraphQL Address Resolver Missing Authorization PII Disclosure (CVE-2025-44010)

More from this source