Live › vulnerability › CVE-2026-112776
Go to dashboardCraft CMS 5.0.0 through 5.10.x does not check the site scope of GraphQL tokens on mutations. A token limited to one site can create entries in other sites and delete shared entries, categories, tags, and assets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
5.0.0 up to but not including 5.11.0 are affected5.11.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
This page as .md · .json · in your agent: get_signal("CVE-2026-112776")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.