Advisory · CVE-2026-112776
Craft CMS GraphQL tokens scoped to one site can mutate other sites' content
Craft CMS 5.0.0 before 5.11.0 does not enforce requireAllowedSite() on several GraphQL mutations, so a token scoped to one site can create entries in another site and delete entries, categories, tags, and assets shared across sites. CVSS 3.1 9.8.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-112776
CWE-863 - Action timing
- Immediate
Explain it like I’m five
A GraphQL key cut for one site is never asked which site it belongs to on several mutation doors, so it can write and delete in the other sites too.
- 01Site-scoped token held
An attacker holds a GraphQL token scoped to a single site, site A.
- 02Foreign siteId supplied
The attacker runs an entry-create mutation naming site B in the siteId argument.
- 03Scope check missing
The create branch never calls requireAllowedSite(), unlike the update branch.
- 04Cross-site mutation
Entries are created in site B, and entries, categories, tags, and assets that also exist in an allowed site can be deleted.
What happened
Craft CMS disclosed CVE-2026-112776 (CWE-863) for versions 5.0.0 before 5.11.0: the GraphQL entry-create branch, deleteEntry without a siteId, and the category, tag, and asset delete mutations do not enforce requireAllowedSite(). A token scoped to site A can therefore create entries in site B by supplying its siteId.
The vendor advisory bounds the delete impact: element fetching stays confined to the token’s allowed sites, so deletions reach elements that also exist in an allowed site, plus shared elements across all sites. Per the vendor affected data in the NVD record, 5.11.0 is the first unaffected release.
What to do
- Inventory Craft CMS sites and note whether each runs the 4.x or 5.x line.
- Upgrade affected sites to 5.11.0 or later using the project release guidance.
- Restrict Control Panel access to trusted networks and named administrators while remediation is underway.
- Hunt for GraphQL mutations from site-scoped tokens that name a different siteId, and unexpected entry, category, tag, or asset deletions.
- Verify the deployed version after updating, not just that an update ran.
Management note
Multi-site installs hand scoped tokens to agencies, integrations, and headless front ends on the assumption the scope holds. Until patched, it does not: inventory every GraphQL token and treat cross-site content changes as integrity incidents.