CVE-2026-124426 · Package
NO FIX YET · SEE WHAT TO DO
Craft CMS 5.0.0 before 5.11.2 fails to enforce a GraphQL schema's Sites scope when the localized field is requested without a siteId argument. An unauthenticated attacker can send a POST to /actions/graphql/api and read content from sites outside that scope.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Craft CMS 5.0.0 through 5.10.x that expose the GraphQL API at /actions/graphql/api are exposed. The attacker only needs to send a request without a siteId argument to read content from sites outside the schema's scope. Sites not running Craft 5, or without a public GraphQL endpoint, can skip it.
Not affected if no-public-graphql, not-craft-5
Who cares craft-cms, graphql, php, self-hosted
composer show craftcms/cms5.11.2 or laterCraft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.