CVE-2026-112776 in Craft CMS
Summary
by MITRE • 10/19/2026
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions 5.0.0 through 5.10.x are affected by a critical authorization bypass vulnerability within the GraphQL API implementation. This flaw stems from an incomplete enforcement of access controls when handling multi-site content operations. Specifically, the system fails to properly validate that the authenticated user or token possesses permissions for the target site being modified. The core technical deficiency lies in the absence of strict adherence to the requireAllowedSite() check during mutation requests. In a typical secure implementation, this function should verify that the current session's allowed sites include the siteId specified in the request payload. However, due to this oversight, the application accepts mutations targeting any valid site ID associated with the installation, regardless of whether the authenticated token is scoped exclusively to a different site.
The operational impact of this vulnerability is significant for organizations utilizing Craft CMS multi-site features where content isolation between sites is required. An attacker possessing a GraphQL access token restricted to Site A can exploit this flaw to perform unauthorized write operations on Site B or any other configured site within the same installation. By manipulating the siteId parameter in mutation requests, an adversary can create new entries, delete existing ones, and modify categories, tags, and assets that are shared across multiple sites. This capability effectively nullifies the intended security boundary between distinct websites hosted under a single Craft CMS instance. The ability to delete or alter content leads directly to data integrity compromise and potential service disruption for affected sites.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves an actor obtaining privileges they are not authorized to have. Furthermore, the exploitation technique corresponds to ATT&CK T1078, Valid Accounts, where attackers leverage legitimate credentials or tokens but abuse their scope of access through misconfiguration or logic flaws in authorization checks. The lack of proper site-scoping enforcement represents a fundamental failure in implementing least privilege principles for multi-tenant environments within the application framework.
Mitigation strategies must prioritize immediate patching to version 5.11.0 or later, where this authorization check has been corrected. Until an upgrade is feasible, administrators should implement strict network-level controls such as Web Application Firewalls (WAF) rules that inspect GraphQL mutation payloads for suspicious siteId values inconsistent with the token's scope if possible. Additionally, reviewing and restricting API access policies to ensure minimal necessary permissions can reduce the blast radius of potential exploitation. Regular audits of multi-site configurations and permission sets are recommended to identify other potential misconfigurations that could lead to similar privilege escalation or data leakage issues in complex CMS deployments.