Craft CMS CVE-2026-84796

Exploitation requires possession of a valid Craft CMS GraphQL API token with at least mutation-level permissions on any site within the target installation (CVSS PR:L). The attacker must be targeting a Craft installation running in multi-site mode, where the GraphQL mutation endpoint is network-accessible. Single-site installations are not meaningfully affected by the cross-site scope bypass. Exploitation is further limited to Craft CMS 5.x versions prior to 5.10.11; no special non-default configuration is required beyond having GraphQL mutations enabled (which is standard for headless Craft deployments). The siteId argument must be passed explicitly in the mutation payload; no additional steps such as user interaction or elevated privilege are needed beyond the initial token.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H scores 8.7, reflecting that network exploitation requires only a low-privilege credential (any valid GraphQL API token) and no attack complexity or user interaction. For single-site Craft deployments, the practical impact of the bypass is negligible since all content lives in one site scope. The risk profile changes substantially for multi-site installations, where the expectation of site isolation may be a contractual or security boundary - even a mid-sized municipal IT team in mielec running a shared Craft installation for multiple departments should treat this as urgent, since a compromised or over-permissioned API token for one site becomes a lever to reach all site content. KEV status is not listed and no public exploit code has been identified at time of analysis; EPSS data is absent from available input. The low attack complexity and low privilege requirement mean that any party holding a legitimately issued GraphQL token - including headless front-end systems or third-party integrations - is a potential exploitation vector.

An attacker in possession of a legitimately issued Craft CMS GraphQL API token scoped to Site A - obtained through credential theft, a compromised integration service, or an over-permissioned third-party application - crafts a standard GraphQL entry mutation and includes a siteId argument corresponding to Site B. Because the mutation resolver passes the argument through ArgumentManager::prepareArguments() without validating site-level authorization, the operation executes against Site B, allowing the attacker to exfiltrate, tamper with, or delete entries in that site. No public exploit code is known, but the technique requires only standard GraphQL query knowledge.