CVE-2026-84799 in Craft CMS
Summary
by MITRE • 09/02/2026
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
Craft CMS versions prior to 5.11.0 contain an authorization bypass vulnerability within its native GraphQL implementation that allows attackers to access sensitive user information beyond the permissions granted by their assigned scopes. The core issue lies in how the system handles relations for specific fields such as author, authors, uploader, draftCreator, and revisionCreator. When a query is executed using a scoped GraphQL token, which typically restricts data visibility based on predefined group memberships or role-based access controls, these particular relation fields fail to apply the necessary scope filters. This architectural flaw means that while general content queries might be correctly restricted, the underlying logic for resolving user relationships does not validate whether the requesting user has permission to view the target entity's details. Consequently, an attacker possessing a limited-access token can traverse these relations to retrieve data associated with any content creator or uploader within the system.
The operational impact of this vulnerability is significant as it leads to unauthorized information disclosure involving personally identifiable information and administrative credentials. Attackers can extract usernames, email addresses, and full names from all users who have authored content, uploaded files, created drafts, or generated revisions in the CMS environment. This includes high-privilege accounts such as administrators, which are typically protected by strict access controls that this flaw circumvents. The exposure of administrative contact information facilitates further attack vectors including targeted phishing campaigns, credential stuffing attacks if passwords are reused across services, and social engineering efforts aimed at gaining deeper system access. By bypassing the intended isolation between different user groups, the vulnerability effectively nullifies the security boundaries established by Craft CMS's role-based access control model for these specific data points.
From a technical classification perspective, this flaw aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the exposed data includes authentication-related identifiers that could aid in brute-force attacks. In terms of offensive security frameworks, it maps to ATT&CK technique T1078 Valid Accounts, as attackers leverage legitimate but restricted credentials to access unauthorized resources, specifically leveraging API endpoints which fall under T1190 Exploit Public-Facing Application. The vulnerability highlights a common pitfall in GraphQL implementations where relation resolution logic is not consistently audited for authorization checks across all field types, particularly those that involve cross-referencing user entities against content ownership records.
Mitigation strategies require immediate upgrading to Craft CMS version 5.11.0 or later, which addresses the scope filtering mechanism within these specific GraphQL fields. Until an upgrade can be performed, administrators should implement strict input validation and additional authorization checks at the application layer if custom resolvers are used for user relations. It is also advisable to review API access logs for unusual patterns of queries targeting author or uploader fields by low-privilege accounts, as this may indicate active exploitation attempts. Furthermore, organizations should ensure that GraphQL tokens are issued with the principle of least privilege and regularly rotated to minimize the window of exposure if a token is compromised. Regular security audits focusing on relation resolution logic in API endpoints can help identify similar implementation gaps before they are exploited by malicious actors seeking to escalate privileges or exfiltrate sensitive user data.