Threats Tagged 'ghsa-vgpq-xf77-c94c'

1 threat

Threats Tagged 'ghsa-vgpq-xf77-c94c'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	EPSS 0.3%	CVE-2026-112776cms · Incorrect Authorization Critical9.3EPSS 0.3%2026-10-19CVE Database V5CVE-2026-112776 Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites. EPSS 0.3%Vulnerability craftcms #ghsa-vgpq-xf77-c94c	CVE Database V5	2026-10-19

Showing 1–1 of 1 result