CVE-2026-92594

Craft CMS 5.0.0-RC1 through versions before 5.11.0 gate the GraphQL draftCreator and revisionCreator fields with only the elements.drafts:read or elements.revisions:read scopes instead of the user-data scope (usergroups.*:read) enforced by Gql::canQueryUsers(), and the resolver returns a raw User element with no per-field authorization. Any client holding just the drafts or revisions scope — or an unauthenticated client, if the operator has enabled the public GraphQL schema with those scopes — can query these fields and harvest the email addresses, usernames, full names, and postal addresses of all draft and revision creators, typically site editors and administrators. No privilege escalation or code execution is involved; the impact is confidentiality of user PII (CWE-200), consistent with the 8.7 high CVSS 4.0 score. All sites running the affected Craft CMS 5.x range are vulnerable in principle, with actual exposure depending on whether a GraphQL schema (public or token-based) grants the drafts or revisions scopes. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no exploitation has been reported; a fix is available in Craft CMS 5.11.0.

What to do: Upgrade to Craft CMS 5.11.0, which fixes the field-level authorization. Until then, remove the elements.drafts:read and elements.revisions:read scopes from the public GraphQL schema and from any API tokens that don't need them, and audit existing GraphQL schemas/tokens for those grants. Check GraphQL access logs for queries requesting draftCreator or revisionCreator fields to detect past PII harvesting.