CVE-2026-79990 Overview
Craft CMS contains an authorization bypass in its GraphQL mutation resolvers that allows cross-site entry manipulation. The saveEntry and deleteEntry resolvers read siteId directly from $arguments without routing through ArgumentManager::prepareArguments(). That function enforces site-scope filtering by applying array_intersect against the sites allowed by the GraphQL schema. Because mutations skip this control, an attacker holding a token scoped to Site A can create, modify, or delete entries in Site B by supplying the target siteId in the mutation arguments. The read path (ElementResolver::prepareElementQuery) correctly enforces scoping, so the flaw is limited to write operations. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.
Critical Impact
An authenticated GraphQL client scoped to one site can create, modify, or delete entries across every site defined in the Craft CMS installation.
Affected Products
- Craft CMS (GraphQL API)
- Craft CMS versions prior to 5.10.11
- Installations issuing site-scoped GraphQL tokens for multi-site deployments
Discovery Timeline
- 2026-09-02 - CVE-2026-79990 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-79990
Vulnerability Analysis
Craft CMS exposes a GraphQL API where tokens can be scoped to specific sites in a multi-site installation. The intended enforcement runs inside ArgumentManager::prepareArguments(), which intersects the siteId argument with the schema's allowed sites and drops any unauthorized values. Element queries route through ElementResolver::prepareElementQuery, which invokes this preparation step. Mutation resolvers for entry writes do not. The saveEntry and deleteEntry resolvers pull siteId straight from $arguments, so the filtering never executes for write operations.
The consequence is a broken access control gap between reads and writes. A token that cannot read entries from Site B can still author or destroy them in Site B. This inverts the least-privilege model administrators expect when issuing scoped tokens. Impact includes unauthorized content creation, defacement, mass deletion, and integrity loss across sites that share a single Craft installation.
Root Cause
The root cause is inconsistent input normalization between query and mutation resolvers. ArgumentManager::prepareArguments() is the sole location that enforces site scope via array_intersect. Mutation resolvers bypass that call and trust the raw siteId supplied by the client, violating the assumption that every resolver sanitizes arguments identically.
Attack Vector
Exploitation requires a valid GraphQL token with permission to invoke entry mutations. The attacker issues a saveEntry or deleteEntry mutation and supplies a siteId corresponding to a site outside their token's schema scope. The resolver honors the value and performs the write against the targeted site. No user interaction is required, and the request is a standard authenticated GraphQL call.
See the GitHub Security Advisory GHSA-3wcr-p33w-528f for the vendor's technical description of the bypass.
Detection Methods for CVE-2026-79990
Indicators of Compromise
- GraphQL mutation requests containing saveEntry or deleteEntry with a siteId value not present in the caller's schema scope.
- Unexpected entry creation, modification, or deletion events in Craft CMS audit logs tied to tokens scoped to a different site.
- Spikes in cross-site write activity originating from a single GraphQL token.
Detection Strategies
- Parse Craft CMS web server logs for POST requests to the GraphQL endpoint whose bodies contain saveEntry or deleteEntry combined with siteId parameters.
- Correlate GraphQL token identifiers to their assigned schema and alert when write operations reference sites outside that schema.
- Compare entry dateCreated and dateUpdated timestamps against the site scope of the authoring token during retrospective review.
Monitoring Recommendations
- Enable verbose GraphQL request logging to capture the operation name, variables, and token identifier for every mutation.
- Forward Craft CMS application logs and web access logs to a centralized analytics platform for cross-token correlation.
- Baseline normal mutation volume per token so that anomalous cross-site writes trigger alerts.
How to Mitigate CVE-2026-79990
Immediate Actions Required
- Upgrade Craft CMS to release 5.10.11 or later, which routes mutation arguments through ArgumentManager::prepareArguments().
- Rotate all GraphQL tokens after upgrading and audit which schemas each token is bound to.
- Review recent entry creation, modification, and deletion events for writes performed by tokens outside their intended site scope.
Patch Information
The fix is available in Craft CMS Release 5.10.11. The patch ensures that saveEntry and deleteEntry resolvers invoke the same argument preparation pipeline as query resolvers, applying array_intersect against the schema's allowed sites before the mutation proceeds. Full source is available in the Craft CMS GitHub repository.
Workarounds
- Disable entry mutations in public GraphQL schemas until the patched release is deployed.
- Restrict GraphQL endpoint access to trusted networks or authenticated administrative users while remediation is pending.
- Revoke GraphQL tokens that are not actively required by production integrations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
