CVE-2026-92594: Craft CMS Information Disclosure Vulnerability

CVE-2026-92594 is an information disclosure flaw in Craft CMS that exposes user data through improper GraphQL authorization. Attackers can harvest email addresses and personal information of site editors. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-92594 Overview

CVE-2026-92594 is an information disclosure vulnerability in Craft CMS affecting versions 5.0.0-RC1 through releases before 5.11.0. The flaw allows a client holding only the GraphQL elements.drafts:read or elements.revisions:read scope to harvest personal information about draft and revision creators. Exposed fields include email, username, full name, and postal addresses of site editors and administrators. When the operator has enabled the public GraphQL schema with either scope, unauthenticated attackers can extract this data over the network. The issue is tracked under [CWE-200] and is fixed in Craft CMS 5.11.0.

Critical Impact
Unauthenticated attackers can enumerate email addresses, usernames, full names, and postal addresses of Craft CMS editors and administrators when the public GraphQL schema exposes draft or revision scopes.

Affected Products

Craft CMS 5.0.0-RC1 through versions before 5.11.0
Craft CMS installations exposing the public GraphQL schema with elements.drafts:read
Craft CMS installations exposing the public GraphQL schema with elements.revisions:read

Discovery Timeline

2026-09-16 - CVE-2026-92594 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92594

Vulnerability Analysis

Craft CMS exposes a GraphQL API where field-level access is gated by scopes. The draftCreator and revisionCreator fields on draft and revision element types return a User element representing the author. Correct authorization requires the user-data scope enforced by Gql::canQueryUsers(), which maps to usergroups.*:read. The vulnerable code path skips that check and gates these resolvers only on elements.drafts:read and elements.revisions:read.

The returned User object exposes email, username, fullName, and addresses without any per-field authorization. Any caller with the drafts or revisions scope receives the underlying personal data. When the public GraphQL schema is enabled with either scope, the caller does not need to authenticate. Attackers can iterate through drafts and revisions to enumerate every content contributor on the site.

Root Cause

The root cause is a missing authorization check on GraphQL resolvers. The draftCreator and revisionCreator fields resolve to raw User elements rather than a filtered type that enforces Gql::canQueryUsers(). This breaks the intended separation between the drafts, revisions, and user-data scopes.

Attack Vector

The attack is remote and requires no user interaction. An attacker sends a GraphQL query requesting draftCreator or revisionCreator along with the sensitive fields email, username, fullName, and addresses. On installations where the public schema exposes drafts or revisions, the query succeeds without authentication. The attacker then paginates through all drafts and revisions to build a directory of privileged users and their personal data.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-pcmv-c398-gc5m and the VulnCheck Advisory on Craft CMS for full technical details.

Detection Methods for CVE-2026-92594

Indicators of Compromise

GraphQL requests to /api or the configured GraphQL endpoint containing draftCreator or revisionCreator field selections.
Queries requesting email, username, fullName, or addresses sub-fields on returned User objects.
Unauthenticated GraphQL traffic paginating across drafts or revisions from a single source address.
Anomalous volume of GraphQL introspection queries preceding targeted field selection.

Detection Strategies

Enable GraphQL query logging and alert on requests referencing draftCreator or revisionCreator combined with user PII fields.
Baseline normal public GraphQL traffic and flag deviations in query shape or client identity.
Correlate web server access logs for high-volume POSTs to the GraphQL endpoint from non-authenticated sessions.

Monitoring Recommendations

Audit configured GraphQL schemas and record which scopes are enabled on the public schema.
Forward web application firewall and reverse proxy logs to a centralized analytics platform for retrospective hunting.
Track outbound bulk responses from the GraphQL endpoint that contain email or address patterns.

How to Mitigate CVE-2026-92594

Immediate Actions Required

Upgrade Craft CMS to version 5.11.0 or later on all affected installations.
Review every configured GraphQL schema and remove elements.drafts:read and elements.revisions:read from the public schema unless explicitly required.
Rotate any Craft CMS GraphQL tokens that may have been shared with untrusted clients.
Notify site editors and administrators whose PII may have been exposed and monitor for phishing directed at those accounts.

Patch Information

Craft CMS 5.11.0 fixes the authorization check on the draftCreator and revisionCreator resolvers so that Gql::canQueryUsers() gates access to user fields. Refer to the GitHub Security Advisory GHSA-pcmv-c398-gc5m for the vendor fix commit and detailed remediation guidance.

Workarounds

Disable the public GraphQL schema until the upgrade to 5.11.0 is complete.
Restrict the GraphQL endpoint at the reverse proxy or WAF to authenticated internal clients only.
Remove the drafts and revisions scopes from any token accessible outside trusted networks.

bash

# Example: verify Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.11.0 --update-with-dependencies
php craft up