{"id":"CVE-2026-112776","kind":"vulnerability","aliases":["CVE-2026-112776"],"related":[],"title":"Craft CMS: site-scoped GraphQL tokens can edit other sites' content","description":"Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.","summary":"Craft CMS 5.0.0 through 5.10.x does not check the site scope of GraphQL tokens on mutations. A token limited to one site can create entries in other sites and delete shared entries, categories, tags, and assets.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","graphql","multi-site","php","runtime"],"not_affected_if":["craft-below-5.0.0","no-graphql-tokens","single-site"],"how_to_check":"Check the Craft version in composer.lock (craftcms/cms); versions from 5.0.0 up to but not including 5.11.0 are affected. Review GraphQL tokens for any that are scoped to a single site.","fix":"Upgrade craftcms/cms to 5.11.0 or later. Rotate GraphQL tokens that were scoped to one site and check entries in other sites for unexpected changes.","status":"open","published_at":"2026-10-19T20:17:54+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:56+00:00","updated_at":"2026-10-23T22:39:56+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:39:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade craftcms/cms to 5.11.0 or later. Rotate GraphQL tokens that were scoped to one site and check entries in other sites for unexpected changes.","reach":"internet","title":"Craft CMS: site-scoped GraphQL tokens can edit other sites' content","impact":"high","summary":"Craft CMS 5.0.0 through 5.10.x does not check the site scope of GraphQL tokens on mutations. A token limited to one site can create entries in other sites and delete shared entries, categories, tags, and assets.","category":"runtime","who_cares":["craft-cms","php","graphql","multi-site"],"confidence":0.8,"needs_auth":"yes","worst_case":"Token holder modifies or deletes content across sites","analyst_note":"","how_to_check":"Check the Craft version in composer.lock (craftcms/cms); versions from 5.0.0 up to but not including 5.11.0 are affected. Review GraphQL tokens for any that are scoped to a single site.","needs_analyst":false,"not_affected_if":["craft-below-5.0.0","no-graphql-tokens","single-site"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":2966,"output_tokens":430,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112776':15A,18A '-2026':14A,17A '5.0.0':30B,68C '5.10':32B '5.11.0':70C 'across':117C 'allow':77C 'asset':64B,115C 'attack':93C 'author':73C 'b':105C 'bypass':74C 'categori':61B,112C 'check':36B 'cms':2A,21B,29B,66C 'contain':71C 'content':12A,87C 'craft':1A,20B,28B,65C 'craft-cm':19B 'creat':52B,101C 'cve':13A,16A 'delet':58B,110C 'edit':9A 'enforc':92C 'entri':53B,60B,102C,111C 'graphql':6A,22B,41B,81C 'hold':94C 'limit':47B 'multi':24B 'multi-sit':23B 'mutat':44B,84C 'one':49B 'php':26B 'requireallowedsit':89C 'runtim':27B 'scope':5A,39B,80C 'share':59B,116C 'site':4A,11A,25B,38B,50B,56B,79C,86C,97C,104C,118C 'site-a':96C 'site-scop':3A,78C 'siteid':108C 'suppli':107C 'tag':62B,113C 'token':7A,42B,46B,82C,99C 'via':106C 'vulner':75C 'x':33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112776","severity":null,"published_at":"2026-10-19T20:17:54+00:00","modified_at":"2026-10-20T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}