CVE-2026-84799: Improper Authorization in craftcms cms

CVE-2026-84799 describes an improper authorization vulnerability in Craft CMS prior to version 5.11.0. The system fails to enforce user-group scope filters on native GraphQL user relations fields including author, authors, uploader, draftCreator, and revisionCreator. As a result, attackers possessing a scoped GraphQL token can query these relations and retrieve sensitive user information such as usernames, email addresses, and full names of any content author or uploader, including those with administrative privileges. This vulnerability exposes sensitive user data due to insufficient access control on GraphQL queries.

Attackers with a scoped GraphQL token can access sensitive user information that should be restricted by user-group scope filters. This includes usernames, email addresses, and full names of content authors and uploaders, including administrators. The exposure of this information could facilitate further targeted attacks or social engineering but does not directly indicate privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a patch is available, restrict GraphQL token scopes and limit access to trusted users to reduce exposure.