CVE-2026-79990

CVE-2026-79990 is an authorization bypass (CWE-639) in the GraphQL API of Craft CMS: the saveEntry and deleteEntry mutation resolvers read the siteId argument directly from user input instead of routing it through ArgumentManager::prepareArguments(), the function that enforces each GraphQL schema's allowed-sites filter via array_intersect. Because of this, a client authenticating with a token scoped to one site can supply a different siteId in a mutation and create, modify, or delete entries on that other site without any site-scope check; the query path is unaffected because it does call prepareArguments(). An attacker needs only a low-privilege, site-scoped GraphQL token, gaining unauthorized write access to content in other sites of a multi-site installation (CVSS 4.0: 8.7 High, network vector, low privileges required). Only Craft CMS installations that expose the GraphQL API and use tokens or schemas scoped to a subset of their configured sites are affected; single-site installs or tokens already permitted to access all sites are not impacted. No public proof-of-concept exists, the issue is not in CISA KEV, and EPSS assigns a 0.3% probability of exploitation within 30 days (17th percentile), so exploitation is not currently known.

What to do: Check whether your Craft CMS deployment exposes the GraphQL endpoint and whether any schemas or tokens are scoped to a subset of the install's sites; until patched, treat such tokens as able to write to any site in the install, review entry logs for unexpected cross-site changes, and consider temporarily restricting mutation access. Upgrade to the patched Craft CMS release identified in the vendor advisory (fixed version not given in the provided data).