CVE-2026-84796: Authorization Bypass Through User-Controlled Key in craftcms cms
Description
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.
CVSS v4.0
Score 8.7high
Affected software
craftcms
cms
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84796 is an authorization bypass vulnerability affecting Craft CMS prior to version 5.10.11. The flaw exists in the GraphQL entry mutation resolvers where the siteId parameter is not validated through ArgumentManager::prepareArguments(). This allows an attacker possessing a token scoped to a single site to bypass site scope restrictions and read, modify, or delete entries on other sites by directly passing a siteId in mutation arguments.
Potential Impact
Attackers with limited site-scoped tokens can escalate privileges to access or modify content across unauthorized sites within the same Craft CMS installation. This could lead to unauthorized data disclosure, modification, or deletion of content entries across sites.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict token scopes carefully and monitor for unusual GraphQL mutation activity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-02T10:19:06.330Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a980702acd9273b492a9195
Added to database: 09/02/2026, 11:22:42 UTC
Last enriched: 09/07/2026, 13:46:44 UTC
Last updated: 10/17/2026, 06:48:21 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.