CVE-2026-84799: Craft CMS GraphQL Information Disclosure

CVE-2026-84799 Overview

Craft CMS versions before 5.11.0 fail to enforce user-group scope filters on native GraphQL user relations. The affected fields include author, authors, uploader, draftCreator, and revisionCreator. Attackers holding a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader, including administrators. The flaw maps to CWE-285: Improper Authorization and exposes personally identifiable information (PII) through an authenticated but low-privileged API surface.

Critical Impact
A GraphQL token holder can enumerate PII for every user referenced by content entries, including administrator accounts, bypassing user-group access controls intended to scope the token.

Affected Products

Craft CMS versions prior to 5.11.0
Craft CMS instances exposing GraphQL endpoints with scoped tokens
Deployments using native user relation fields (author, authors, uploader, draftCreator, revisionCreator)

Discovery Timeline

2026-09-02 - CVE-2026-84799 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84799

Vulnerability Analysis

Craft CMS exposes user data through GraphQL relations attached to content entries and assets. The schema allows queries to traverse from an entry to its author, from an asset to its uploader, and from drafts or revisions to their creators. Craft's GraphQL permission model supports scoping tokens so that a token can only read specific user groups. The scoping is enforced on top-level user queries but is not propagated to native relation resolvers on entries, assets, drafts, and revisions.

As a result, any token that can read entries or assets can dereference the associated user object and return fields such as username, email, and fullName. The disclosure covers accounts outside the token's authorized user-group scope, including administrative accounts. This is an authorization boundary failure rather than an authentication flaw; the attacker must already possess a valid GraphQL token.

Root Cause

The root cause is missing authorization enforcement in the resolvers backing user relation fields on entries, assets, drafts, and revisions. Scope filters that restrict which user groups a token can query are applied only at the root users query. Relation resolvers bypass these filters and return the underlying user record whenever the parent element is accessible.

Attack Vector

An attacker with a low-privileged scoped GraphQL token issues a query that requests entries, assets, drafts, or revisions and selects the nested author, authors, uploader, draftCreator, or revisionCreator fields. The response contains PII for users the token should not be able to enumerate. The attack requires network access to the GraphQL endpoint and a valid token, with no user interaction. See the GitHub Security Advisory GHSA-4w9w-3x96-7ghp and the VulnCheck Advisory on Craft CMS for additional detail.

Detection Methods for CVE-2026-84799

Indicators of Compromise

GraphQL requests to /actions/graphql/api or the configured GraphQL endpoint selecting author, authors, uploader, draftCreator, or revisionCreator fields together with email, username, or fullName.
Unusually high volumes of entry, asset, draft, or revision queries originating from a single API token or IP address.
Access log entries showing GraphQL queries containing user-relation fragments from tokens that historically only read content.

Detection Strategies

Enable GraphQL query logging and parse queries for user-relation fields combined with PII selections. Flag any token that reads administrator email addresses.
Baseline normal GraphQL usage per token, then alert on deviations in query shape or user-record volume returned.
Correlate GraphQL responses against user-group scope assigned to each token; investigate any response returning users outside the token's declared scope.

Monitoring Recommendations

Forward web server and Craft CMS application logs to a central analytics platform and retain GraphQL request bodies where policy allows.
Monitor issuance and use of scoped GraphQL tokens, and alert on new tokens created outside the change-management process.
Track failed and successful queries against user relations after patching to confirm that scope enforcement is now returning empty results as expected.

How to Mitigate CVE-2026-84799

Immediate Actions Required

Upgrade Craft CMS to version 5.11.0 or later on all environments that expose GraphQL.
Rotate all GraphQL tokens after upgrading, and reissue with the minimum scopes necessary.
Audit historical GraphQL logs for queries that referenced user-relation fields and notify affected users if administrator PII was exposed.

Patch Information

Pitchfork the fix by upgrading to Craft CMS 5.11.0, which enforces user-group scope filters on the author, authors, uploader, draftCreator, and revisionCreator relations. Refer to the GitHub Security Advisory GHSA-4w9w-3x96-7ghp for the authoritative patch reference.

Workarounds

Disable the GraphQL API in Craft CMS settings if it is not required for production integrations.
Restrict network access to the GraphQL endpoint using a web application firewall or IP allowlist until patching is complete.
Revoke scoped GraphQL tokens that do not require access to entries, assets, drafts, or revisions containing sensitive authors.

bash

# Configuration example: restrict GraphQL endpoint via nginx allowlist
location /actions/graphql/api {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://craft_backend;
}