CVE-2026-84796

CVE-2026-84796 is an authorization bypass (CWE-639) in Craft CMS, where GraphQL entry mutation resolvers fail to validate the siteId argument through ArgumentManager::prepareArguments(). An attacker holding a GraphQL access token scoped to a single site can pass an arbitrary siteId directly in mutation arguments, bypassing the intended site scope. This allows the attacker to read, modify, or delete content entries belonging to other sites within the same Craft installation, which they should not be able to access. Only Craft CMS deployments running affected versions that expose the GraphQL API and use multi-site configurations with site-scoped tokens are practically exposed, and the issue requires authenticated (low-privilege) access. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no active exploitation is currently known.

What to do: Upgrade Craft CMS to version 5.10.11 or later, which validates siteId through ArgumentManager::prepareArguments(). As an interim mitigation, audit GraphQL tokens for site scoping, restrict or disable entry mutations for tokens that do not need them, and review recent entry changes for cross-site modifications made with an unexpected siteId.