CVE-2026-84796: Craft CMS GraphQL Auth Bypass Vulnerability

CVE-2026-84796 Overview

CVE-2026-84796 is a site scope bypass vulnerability in Craft CMS versions before 5.10.11. The flaw resides in GraphQL entry mutation resolvers that fail to validate the siteId parameter through ArgumentManager::prepareArguments(). Attackers holding a GraphQL token scoped to a single site can read, modify, or delete entries across unauthorized sites by supplying an arbitrary siteId directly in mutation arguments. The weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. Exploitation requires only low-privilege network access and no user interaction, giving cross-tenant impact on confidentiality, integrity, and availability of entry data.

Critical Impact
A low-privileged GraphQL token can pivot beyond its assigned site scope and manipulate entries belonging to other sites in the same Craft CMS installation.

Affected Products

Craft CMS 5.0.0-RC1 through versions prior to 5.10.11
Craft CMS GraphQL API entry mutation resolvers
Multi-site Craft CMS deployments using scoped GraphQL tokens

Discovery Timeline

2026-09-02 - CVE-2026-84796 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84796

Vulnerability Analysis

Craft CMS supports multi-site content models where each entry belongs to a specific site, and GraphQL tokens can be scoped to restrict access to designated sites. Entry mutation resolvers accept a siteId argument to indicate which site an operation targets. In vulnerable releases, ArgumentManager::prepareArguments() does not enforce that the supplied siteId falls within the caller's token scope. The resolver treats the client-supplied identifier as authoritative and proceeds with the mutation against the requested site.

The vulnerability is a broken access control issue where authorization decisions rely on a user-controlled key. An attacker who legitimately holds a token for one site can enumerate site identifiers and issue mutations against any other site in the installation. Impacted operations include creating, updating, and deleting entries, which can be used to inject content, alter published pages, or remove records outright.

Root Cause

The root cause is missing server-side authorization on the siteId mutation argument. Craft CMS trusts the client-supplied value instead of cross-checking it against the token's scoped sites list before executing the entry mutation. This aligns with [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation is remote and requires a valid GraphQL token with any level of entry mutation privilege. The attacker sends a standard GraphQL mutation to the Craft CMS endpoint and supplies a siteId value corresponding to a site outside the token's scope. Because the resolver does not validate the argument, the mutation executes against the target site. No user interaction is required.

See the GitHub Security Advisory and the VulnCheck Security Advisory for advisory-level technical details.

Detection Methods for CVE-2026-84796

Indicators of Compromise

GraphQL mutation requests containing siteId values that do not match the authenticated token's scoped sites.
Unexpected entry create, update, or delete operations attributed to low-privileged API tokens.
Audit log entries showing content changes on sites the acting token was not authorized to modify.

Detection Strategies

Parse GraphQL request logs and correlate the siteId argument in saveEntry, deleteEntry, and related mutations against the token's authorized site scope.
Alert when a single token issues mutations targeting multiple siteId values within a short time window.
Baseline normal per-token site access patterns and flag deviations, particularly for tokens issued to third parties or integrations.

Monitoring Recommendations

Enable verbose logging on the Craft CMS GraphQL endpoint and forward logs to a centralized analytics platform.
Monitor the Craft CMS entries table for unexpected changes to siteId, authorId, and dateUpdated fields.
Track GraphQL error rates and 200-response mutations from tokens historically limited to read operations.

How to Mitigate CVE-2026-84796

Immediate Actions Required

Upgrade Craft CMS to version 5.10.11 or later on all environments.
Rotate all GraphQL tokens after patching to invalidate any credentials that may have been misused.
Audit entry history and content changes on multi-site installations for unauthorized modifications during the exposure window.

Patch Information

The Craft CMS maintainers released a fix in version 5.10.11. The patch adds site scope validation to entry mutation resolvers so that ArgumentManager::prepareArguments() rejects siteId values outside the caller's authorized sites. Full details are available in the GitHub Security Advisory GHSA-3wcr-p33w-528f.

Workarounds

Disable GraphQL entry mutations for tokens that do not require write access until the upgrade is applied.
Restrict access to the GraphQL endpoint at the web server or WAF layer to trusted networks and identities.
Reduce token scopes to the minimum necessary and revoke tokens that are no longer in active use.

bash

# Verify Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.10.11 -w
php craft up