Craft CMS up to 4.17.11/5.9.17 Address.php authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in Craft CMS up to 4.17.11/5.9.17. Affected by this issue is some unknown functionality of the file src/gql/resolvers/elements/Address.php. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2026-44010. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Craft CMS up to 4.17.11/5.9.17. It has been declared as problematic. This vulnerability affects an unknown functionality of the file src/gql/resolvers/elements/Address.php. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. CVE summarizes:

Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-44010 since 05/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

By approaching the search of inurl:src/gql/resolvers/elements/Address.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.17.12 or 5.9.18 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Craft

Name

• CMS

Version

• 4.17.0
• 4.17.1
• 4.17.2
• 4.17.3
• 4.17.4
• 4.17.5
• 4.17.6
• 4.17.7
• 4.17.8
• 4.17.9
• 4.17.10
• 4.17.11
• 5.9.0
• 5.9.1
• 5.9.2
• 5.9.3
• 5.9.4
• 5.9.5
• 5.9.6
• 5.9.7
• 5.9.8
• 5.9.9
• 5.9.10
• 5.9.11
• 5.9.12
• 5.9.13
• 5.9.14
• 5.9.15
• 5.9.16
• 5.9.17

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion