FKIE_CVE-2026-79990

Vulnerability from fkie_nvd - Published: 2026-09-02 15:17 - Updated: 2026-09-03 17:45
Severity
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
References
7004884b-51e2-48e8-b4a2-5ca29e80453ehttps://github.com/craftcms/cms
7004884b-51e2-48e8-b4a2-5ca29e80453ehttps://github.com/craftcms/cms/releases/tag/5.10.11
7004884b-51e2-48e8-b4a2-5ca29e80453ehttps://github.com/craftcms/cms/security/advisories/GHSA-3wcr-p33w-528f
7004884b-51e2-48e8-b4a2-5ca29e80453ehttps://www.hckrt.com/hacktivity/HCKRT-XEQKMX
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "craftcms/cms",
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "lessThan": "5.10.11",
              "status": "affected",
              "version": "5.0.0-RC1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft CMS GraphQL entry mutation resolvers (saveEntry,\u00a0deleteEntry) read\u00a0siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via\u00a0array_intersect\u00a0against the GraphQL schema\u2019s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls\u00a0prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely \u2014 an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument."
    }
  ],
  "id": "CVE-2026-79990",
  "lastModified": "2026-09-03T17:45:20.840",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-79990",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-02T17:52:53.038505Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-02T15:17:42.473",
  "references": [
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://github.com/craftcms/cms/releases/tag/5.10.11"
    },
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-3wcr-p33w-528f"
    },
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://www.hckrt.com/hacktivity/HCKRT-XEQKMX"
    }
  ],
  "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.