high8.8
CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentMa…
Impact
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.
Affected products
| Product | Affected versions |
|---|---|
| Craft CMS | before 5.10.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.