CVE-2026-84796
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Sep 02, 2026
Vendor
unknown
Description
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.