CVE-2026-79990: CWE-639 Authorization bypass through User-Controlled key in craftcms cms

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) do not enforce site-scope filtering on the siteId argument because they read it directly from the arguments without passing through ArgumentManager's prepareArguments() function. This function normally enforces site-scope filtering by intersecting allowed sites from the GraphQL schema. While queries correctly call prepareArguments() and thus restrict access, mutations bypass this mechanism entirely. Consequently, an attacker possessing a token scoped to Site A can create, modify, or delete entries in Site B by specifying siteId in the mutation arguments, resulting in an authorization bypass (CWE-639).

An attacker with limited privileges scoped to one site can perform unauthorized mutations (create, modify, delete) on entries belonging to other sites within the same Craft CMS instance. This breaks site-level authorization boundaries, potentially leading to data tampering or unauthorized content changes across sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict GraphQL mutation token scopes carefully and monitor for suspicious mutation activities. Avoid exposing mutation capabilities to untrusted users or tokens scoped to limited sites.