Unauthenticated PII Disclosure Vulnerability in Craft CMS by Pixel & Tonic
CVE-2026-92594

8.7HIGH

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92594?

Craft CMS versions prior to 5.11.0 contain a vulnerability that improperly authorizes access to the GraphQL draftCreator and revisionCreator fields. Instead of implementing proper user-data scope checks, the access is limited to general drafts and revisions scopes. This oversight allows clients, including unauthenticated ones in instances where the public GraphQL schema is enabled, to collect sensitive personal information such as email addresses, usernames, full names, and postal addresses of draft and revision creators, including site editors and administrators. The issue has been rectified in version 5.11.0.

Affected Version(s)

cms 5.0.0-RC1 < 5.11.0

cms 5.11.0

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/craft-cms-before-5.1...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.