{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-112777/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-112776"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Craft CMS (5.0.0 \u003c= 5.10.9)","Craft CMS (4.x \u003c 4.18.8, 5.x \u003c 5.11.0)","Craft CMS (\u003c 4.18.8, \u003c 5.11.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application","cms","graphql","cve","rce","twig","cve-2026-112777"],"_cs_type":"advisory","_cs_vendors":["Craft CMS"],"content_html":"\u003cp\u003eCraft CMS versions 5.0.0 through 5.10.9 contain a critical authorization bypass vulnerability (CVE-2026-112776) stemming from an improperly enforced \u003ccode\u003erequireAllowedSite()\u003c/code\u003e check within the GraphQL API. The vulnerability allows an authenticated attacker, holding a legitimate GraphQL token scoped to a single site, to perform unauthorized mutations on content belonging to other sites within the same multi-site Craft CMS instance.\u003c/p\u003e\n\u003cp\u003eBy manipulating the \u003ccode\u003esiteId\u003c/code\u003e parameter in GraphQL requests, an attacker can create, modify, or delete entries, categories, tags, and assets that they should not have access to. Because this bypasses site-level access controls, it permits cross-site data corruption and potential unauthorized information exposure or service disruption. This vulnerability impacts installations utilizing multi-site configurations where strict tenant isolation is required. Organizations should update to version 5.11.0 or later to ensure that site-scoped tokens are correctly validated before mutation operations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker obtains a valid, site-scoped GraphQL API token for a specific site in a multi-site Craft CMS instance.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the \u003ccode\u003esiteId\u003c/code\u003e of a target site that is not included in the scope of their current token.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a GraphQL mutation request (e.g., \u003ccode\u003ecreateEntry\u003c/code\u003e, \u003ccode\u003edeleteEntry\u003c/code\u003e, or \u003ccode\u003esaveAsset\u003c/code\u003e) targeting the CMS GraphQL endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker injects the \u003ccode\u003esiteId\u003c/code\u003e of the target site into the mutation parameters.\u003c/li\u003e\n\u003cli\u003eThe server processes the GraphQL request without enforcing the \u003ccode\u003erequireAllowedSite()\u003c/code\u003e check for the provided \u003ccode\u003esiteId\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe CMS executes the mutation using the provided \u003ccode\u003esiteId\u003c/code\u003e, resulting in unauthorized data modification or deletion on the target site.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary unauthorized mutations across sites within a single Craft CMS installation. This can result in the deletion of critical business content, unauthorized injection of data, and the compromise of categories, tags, and assets shared across sites. The vulnerability is assigned a CVSS score of 9.8, reflecting the significant risk of unauthorized modification and potential service disruption for enterprise environments utilizing multi-site CMS architectures.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the instance by upgrading to Craft CMS version 5.11.0 or later immediately to resolve CVE-2026-112776.\u003c/li\u003e\n\u003cli\u003eAudit application logs for \u003ccode\u003ePOST\u003c/code\u003e requests to the GraphQL endpoint that contain unusual or unexpected \u003ccode\u003esiteId\u003c/code\u003e parameters associated with site-scoped tokens.\u003c/li\u003e\n\u003cli\u003eImplement egress monitoring for the web server to detect unusual mutation patterns if patching is delayed.\u003c/li\u003e\n\u003cli\u003eReview GraphQL token scope assignments to ensure the principle of least privilege is applied to all API keys and user tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T22:23:49Z","date_published":"2026-10-19T22:23:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-craft-cms-auth-bypass/","summary":"Craft CMS versions 5.0.0 through 5.10.9 contain an authorization bypass vulnerability allowing attackers with site-scoped tokens to manipulate content across unauthorized sites via GraphQL mutations.","title":"Authorization Bypass in Craft CMS GraphQL Mutations","url":"https://feed.craftedsignal.io/briefs/2026-10-craft-cms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-112777","version":"https://jsonfeed.org/version/1.1"}