GraphQL Entry Mutation Vulnerability in Craft CMS by Craft

CVE-2026-79991

What is CVE-2026-79991?

The vulnerability in Craft CMS involves a flaw in the GraphQL entry mutation resolvers, specifically in the functions saveEntry and deleteEntry. These functions improperly read siteId directly from user arguments without routing through the necessary ArgumentManager.prepareArguments() function. This bypass allows an attacker with access to a token for one site (Site A) to perform create, modify, or delete operations on entries in another site (Site B) by manipulating the siteId parameter in mutation requests. This lack of proper site-scope filtering poses a significant security risk and highlights the importance of implementing stringent access control mechanisms.

References