Threats tagged 'ghsa-mj59-pg4q-vh88'

Craft CMS versions from 5.0.0 up to but not including 5.11.2 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to read content from sites outside the intended GraphQL schema's Sites scope by sending a specially crafted POST request to the /actions/graphql/api endpoint. The vulnerability enables disclosure of out-of-scope site content without requiring authentication.