CVE-2026-79990 in Craft CMS
Summary
by MITRE • 09/02/2026
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified involves a critical authorization bypass within Craft CMS GraphQL implementation, specifically affecting entry mutation resolvers such as saveEntry and deleteEntry. This flaw stems from an inconsistent application of security controls between query operations and mutation operations. In standard GraphQL queries handled by ElementResolverprepareElementQuery, the system correctly invokes ArgumentManager prepareArguments(), which enforces site-scope filtering through array_intersect against the schema-defined allowed sites. This mechanism ensures that users can only retrieve data associated with their authorized scope, effectively preventing unauthorized access to content from other sites within a multi-site installation. However, this same protective logic is entirely absent in mutation resolvers responsible for creating, modifying, or deleting entries. Instead of routing input arguments through the ArgumentManager prepareArguments() function, these mutations read siteId directly from $arguments without validation against the user's permitted scope.
This architectural inconsistency creates a severe privilege escalation vector where an attacker possessing a GraphQL token scoped to Site A can manipulate content in Site B by explicitly passing the target site identifier in mutation arguments. The absence of server-side authorization checks allows malicious actors to bypass intended isolation boundaries between distinct sites within the same Craft CMS installation. Since mutations typically involve state-changing operations, this vulnerability poses significant risks including unauthorized data modification, deletion of critical content, and injection of malicious entries into restricted environments. The impact extends beyond simple information disclosure as it enables active compromise of system integrity through unauthenticated or insufficiently authenticated write operations across site boundaries.
From a technical perspective, the root cause lies in the failure to apply consistent input validation and authorization filtering across all GraphQL operation types. While read operations benefit from robust scope enforcement mechanisms, write operations lack equivalent safeguards due to direct argument access bypassing established security middleware. This pattern represents a classic case of inconsistent implementation of security controls where different code paths handle similar inputs with varying levels of scrutiny. The vulnerability aligns with CWE-269 Improper Privilege Management as it allows users to perform actions beyond their authorized permissions, and falls under ATT&CK technique T1078 Valid Accounts since exploitation requires legitimate but limited credentials that are then abused for unauthorized access across organizational boundaries within the application architecture.
Mitigation strategies must focus on ensuring uniform security enforcement across all GraphQL operation types. The primary remediation involves modifying mutation resolvers to route siteId and other scope-related arguments through ArgumentManager prepareArguments() just as query operations do, thereby enforcing array_intersect-based filtering against allowed sites before any database modifications occur. Additionally implementing explicit authorization checks within each mutation resolver would provide defense-in-depth by verifying user permissions regardless of argument handling methods. Organizations should also consider implementing comprehensive input validation frameworks that apply consistent security policies across all entry points rather than relying on disparate implementation patterns. Regular code reviews focusing on privilege escalation vectors and cross-site access controls can help identify similar inconsistencies before they reach production environments, while monitoring for unusual mutation activity targeting unauthorized site identifiers provides an additional layer of operational security awareness.