EUVD-2026-81294
GHSA-f53v-9r85-mf77
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Worst-case public-schema config gives PR:N and high PII confidentiality (C:H); no integrity/availability impact; drops to PR:L (~6.5) when public GraphQL schema is disabled.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
5DescriptionCVE.org
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope - including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes - can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.
AnalysisAI
Craft CMS versions 5.0.0-RC1 through 5.11.0 improperly authorize the GraphQL draftCreator and revisionCreator fields, allowing clients with only elements.drafts:read or elements.revisions:read scopes to retrieve PII (email, username, full name, postal address) of all draft/revision authors, typically editors and administrators. Unauthenticated exploitation is possible only if the operator has enabled the public GraphQL schema with those draft/revision scopes-a non-default configuration; otherwise a valid GraphQL token holding those scopes is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the GraphQL API be reachable AND that a schema (public or token-scoped) grants the elements.drafts:read or elements.revisions:read scope. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a confidentiality-only PII disclosure flaw (CWE-200) rated by the vendor at CVSS 4.0 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Craft CMS 5.11.0 or later; this is the vendor-released patch that fixes the improper authorization (vendor advisory: https://github.com/craftcms/cms/security/advisories/GHSA-pcmv-c398-gc5m; VulnCheck advisory: https://www.vulncheck.com/advisories/craft-cms-before-5.11.0-unauthenticated-pii-disclosure-via-graphql). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Craft CMS instance and determine which run versions 5.0.0-RC1 through 5.11.0 with a GraphQL endpoint; wherever draft or revision data is not a hard business requirement, disable the elements.drafts:read and elements.revisions:read scopes, strip those scopes from existing tokens, and confirm the public GraphQL schema is not enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today