CVE-2026-79990 Details
Description
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
A vulnerability in Craft CMS's GraphQL entry mutation resolvers, specifically 'saveEntry' and 'deleteEntry', allows for unauthorized cross-site content manipulation. This issue arises because the resolvers read 'siteId' directly from the arguments without applying the necessary site-scope filtering. As a result, an attacker with a token for Site A can create, modify, or delete entries in Site B by manipulating the 'siteId' argument. This vulnerability affects Craft CMS versions 5.0.0-RC1 through 5.10.10.
Users can update to Craft CMS version 5.10.11 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms | Hackrate | Source CodeVendor |
| https://github.com/craftcms/cms/releases/tag/5.10.11 | Hackrate | Release NotesVendor |
| https://github.com/craftcms/cms/security/advisories/GHSA-3wcr-p33w-528f | Hackrate | AdvisoryVendor |
| https://www.hckrt.com/hacktivity/HCKRT-XEQKMX | Hackrate | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | Hackrate |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 5.0.0-RC1, < 5.10.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | Hackrate |