CVE-2026-124426Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

Beschreibung

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-mp59-9rf5-93wr) vendor-advisory
• VulnCheck Advisory: Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field third-party-advisory