CVE-2026-124426 | BDVDB-2026-401982 Detail

Description#

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-08Record published in the CVE List.