CVE-2026-112776: Incorrect Authorization in craftcms cms

CVE-2026-112776 is an authorization bypass vulnerability in Craft CMS affecting versions >=5.0.0 and <5.11.0. The vulnerability arises because the requireAllowedSite() function is not enforced when using site-scoped GraphQL tokens, enabling attackers holding a token scoped to one site to mutate content on other sites by supplying arbitrary site IDs. This includes creating entries on other sites and deleting shared content such as entries, categories, tags, and assets.

An attacker with a site-scoped GraphQL token can bypass authorization controls to modify or delete content across multiple sites managed by the same Craft CMS instance. This can lead to unauthorized content creation and deletion, potentially causing data loss, content tampering, and disruption of site operations. The CVSS 4.0 score of 9.3 indicates a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

No explicit patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to GraphQL tokens and monitor for suspicious activity related to cross-site content mutations.