CVE-2026-112776

CVSS 9.8 (critical) · published 2026-10-19

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

Weakness: CWE-863

Source: NVD CVE-2026-112776

References

• https://github.com/craftcms/cms/security/advisories/GHSA-7rr3-4jcm-x526
• https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.0-graphql-site-scope-bypass-via-mutations

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.