Skip to content
Threat Feed

Vendor

Craft CMS

2 briefs RSS
high advisory

Craft CMS GraphQL Address Resolver Missing Authorization Allows PII Disclosure

A missing authorization check in the GraphQL Address element resolver of Craft CMS Pro allows a GraphQL API token scoped to a low-privilege user group to read all addresses in the system, including those belonging to users in groups the token is not authorized to access, exposing personally identifiable information (PII).

cms +2 craftcms graphql pii disclosure
2r 1t
high advisory

Craft CMS Authenticated Remote Code Execution via Malicious Attached Behavior

Craft CMS versions before 4.17.12 and 5.9.18 are vulnerable to authenticated remote code execution via malicious behavior injection in the field layout hydration path.

cms +1 craft-cms rce vulnerability
2r 2t