Craft CMS EUVD-2026-70048

The attacker must hold a valid Craft CMS GraphQL API token with at least PR:L (scoped to one or more sites); unauthenticated access is not sufficient. The Craft CMS installation must have the GraphQL API enabled (not enabled by default in all configurations) and must operate in a multi-site setup with at least two sites defined - the bypass is meaningless in single-site installations because there is no unauthorized site to target. Exploitation consists solely of passing a siteId integer in the mutation $arguments that references a site outside the token's allowed-sites list. Limiting factors: token-level authentication is required (no anonymous exploitation); the GraphQL API must be explicitly enabled; and a multi-site Craft CMS deployment is necessary. Installations using single-site configurations or those with GraphQL disabled are not affected.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the severity: low-complexity network exploitation by any token holder with C/I/A all rated High on the vulnerable system. EPSS data is not provided in the input and KEV status is negative, meaning no confirmed active exploitation is known. Despite the absence of a public exploit, the vulnerability is straightforwardly reproducible by any developer with a GraphQL client and a valid token - the bypass requires only adding a siteId integer to a mutation argument. For organizations running multi-site Craft CMS installations, even a mid-sized municipal IT team in kalisz should treat this as urgent because a compromised low-privilege content editor token could be leveraged to tamper with or destroy content across all sites in the installation. The risk is somewhat constrained by the PR:L prerequisite (a valid token is required) and the need for a multi-site deployment, but within those conditions the impact ceiling is full cross-site content manipulation with no further exploitation complexity.

An attacker who has obtained a valid Craft CMS GraphQL API token - for example, via credential theft, a compromised content editor account, or an exposed automation token - issues a saveEntry mutation while specifying the siteId of a site outside their token's scope. Because ArgumentManager::prepareArguments() is never called in the mutation path, the site-scope check is silently skipped and the entry is created or modified in the target site. The attacker could delete all entries in a production site while their token is nominally scoped only to a staging site, causing full content loss with no further privilege escalation needed.