CVE-2026-124426
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.