CVE-2026-124426Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

Açıklama

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-mp59-9rf5-93wr) vendor-advisory
• VulnCheck Advisory: Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field third-party-advisory