Skip to content

CVE record · 1 source

CVE-2026-112776

CVSS 9.8

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites'…

Vendor: Craft CMS
Product: Craft CMS
CVSS: 9.8
EPSS: 0.004 (p33)
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

23

CVE NVD 12d ago

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites'…

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A…

CVSS 9.8 CVE-2026-112776 Craft CMS