Skip to content
Threat Feed
Subscribe

Product

Craft CMS (4.x < 4.18.8, 5.x < 5.11.0)

1 brief RSS
critical advisory

Authorization Bypass in Craft CMS GraphQL Mutations

Craft CMS versions 5.0.0 through 5.10.9 contain an authorization bypass vulnerability allowing attackers with site-scoped tokens to manipulate content across unauthorized sites via GraphQL mutations.

Craft CMS +2 web-application cms graphql cve rce twig cve-2026-112777
3t 1c