Craft CMS EUVD-2026-69911

Exploitation requires possession of a valid Craft CMS GraphQL API token with at least read access to one content type that has entries associated with user-relation fields (author, authors, uploader, draftCreator, or revisionCreator). The token does not need elevated scope - any low-privilege scoped token suffices. The GraphQL API must be enabled and network-accessible. No special configuration beyond the default CMS setup is required once a token exists. Exploitation is impossible without a token; deployments that have not issued any GraphQL tokens or that use the Control Panel exclusively are not exposed. The leak is limited to PII (usernames, emails, full names) - it does not expose password hashes, session tokens, or other secrets.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) accurately reflects the limited severity: exploitation requires a valid (though low-privilege) GraphQL token, and the impact is confined to information disclosure of PII rather than code execution or data modification. The EPSS signal is not provided, but the low complexity and network-accessible attack vector suggest a non-trivial exploitation probability once token credentials are available. The issue is not in CISA KEV and no POC has been published. Real-world risk is primarily relevant to multi-tenant Craft deployments where API tokens are distributed to third-party integrations or external developers who should not have visibility into admin account details. The 'Authentication Bypass' tag in the input is misleading - this is an authorization scope bypass, not a bypass of authentication; the distinction matters for triage because exploitation is impossible without a token.

An attacker who has obtained a low-privilege Craft GraphQL token scoped to a public-facing content section sends a GraphQL query for published entries and traverses the author or uploader relation fields. The resolver returns full User objects - including the username, email address, and display name of administrators who have authored or approved content - even though the token's user-group scope filter would normally prohibit access to those records. The attacker harvests admin email addresses for follow-on phishing or credential-stuffing campaigns.