Craft CMS CVE-2026-92594

Exploitation requires that the GraphQL API be reachable AND that a schema (public or token-scoped) grants the elements.drafts:read or elements.revisions:read scope. Unauthenticated exploitation is possible ONLY when the operator has explicitly enabled the PUBLIC GraphQL schema with those draft/revision scopes - a non-default configuration. Otherwise an attacker needs a valid GraphQL token holding those scopes (authenticated, PR:L). The attacker then queries the draftCreator/revisionCreator fields, whose resolver returns a raw User element without per-field authorization, exposing email, username, fullName, and postal addresses of all draft/revision creators. Limiting factors: only sites that (a) expose GraphQL, (b) grant drafts/revisions scopes, and (c) actually have drafts/revisions authored by privileged editors/admins are affected; impact is confidentiality-only (PII of editors/admins), no integrity or availability effect.

This is a confidentiality-only PII disclosure flaw (CWE-200) rated by the vendor at CVSS 4.0 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N. The high 8.7 score is driven entirely by the PR:N (unauthenticated) + VC:H (high confidentiality) combination, but the PR:N assumption is CONDITIONAL, not universal: unauthenticated access only applies when the operator has explicitly enabled the public GraphQL schema AND granted it the elements.drafts:read / elements.revisions:read scopes. In the common default deployment (public schema disabled or scopes not granted), the attacker needs a token holding those scopes, effectively PR:L, which materially lowers real-world severity toward my assessed ~6.5-7.5 range. There is no integrity or availability impact (VI:N/VA:N). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The 8.7 therefore represents a worst-case, mis-configuration-gated ceiling rather than a mass-exploitation emergency; it is a legitimate data-leak bug worth patching promptly but not a drop-everything item absent evidence of active exploitation. Signals are consistent (all point to confidentiality-only network disclosure); the main caveat is that the vendor score assumes the public-schema-enabled worst case.

An operator has enabled Craft CMS's public GraphQL schema with the drafts/revisions read scopes for a headless/front-end use case. An unauthenticated attacker sends a GraphQL query requesting the draftCreator/revisionCreator fields and reads back the email, username, full name, and postal address of every editor and administrator who created a draft or revision. No public exploit code is identified in the provided data; the query is trivial to construct once the schema and scopes are exposed.