GraphQL Mutation Vulnerability in Craft CMS by Pixel & Tonic

CVE-2026-79990

What is CVE-2026-79990?

Craft CMS has a vulnerability in its GraphQL entry mutation resolvers, specifically in the saveEntry and deleteEntry functions. These resolvers improperly handle the siteId parameter by reading it directly from the arguments provided to the mutation, bypassing the ArgumentManager::prepareArguments() function, which is essential for enforcing site-specific filtering. As a result, an attacker authenticated to one site can manipulate entries across unauthorized sites by specifying the siteId in their mutation arguments. This issue highlights significant risks for data integrity and access control within multi-site installations of Craft CMS.

References