Key points
- The flaw affects Craft CMS versions 5.0.0 through 5.10.x.
- National Vulnerability Database rates the issue as critical with a CVSS score of 9.3.
- Attackers can create, modify, or delete entries, categories, tags, and assets on other sites.
Craft CMS users running versions from 5.0.0 up to, but not including, 5.11.0 are exposed to a severe security flaw. This authorization bypass vulnerability allows an attacker who possesses a valid GraphQL token for one site to manipulate content on a different site within the same installation. The National Vulnerability Database has assigned this issue a critical severity rating of 9.3.
In plain English
The problem stems from a missing security check called requireAllowedSite(). Because this enforcement is absent, the system does not properly restrict where a site-scoped token can be used. An attacker holding a token for Site A can supply a different site ID in their request. This allows them to create new entries, delete existing content, or alter categories, tags, and assets on Site B.
The background
According to the National Vulnerability Database, this vulnerability is tracked as CVE-2026-112776 and is linked to CWE-863. The flaw exists in the way Craft CMS handles GraphQL mutations across multi-site setups. Without the proper site validation, the application trusts the supplied site ID rather than verifying it against the token's original scope. This gap enables cross-site content mutation.
What changes now
The affected software range is clearly defined as versions starting from 5.0.0 and ending before 5.11.0. Any installation within this version window is vulnerable to this specific authorization bypass. Users must verify their current Craft CMS version to determine if their system falls into the affected range. The critical rating indicates a high likelihood of successful exploitation if an attacker obtains a valid token.
Who needs to act first
Teams usually prioritize systems that are directly accessible to the internet or handle sensitive customer data. Check whether your installation uses multiple sites, as this feature increases the risk surface. Before applying any changes, back up your entire database and file structure to ensure you can restore operations if something goes wrong. Test the update in a staging environment first to verify that existing functionality remains intact. Monitor access logs for unusual GraphQL activity that might indicate an attacker is probing for vulnerabilities.
What to do and how to stay safe: Craft CMS
- Verify your current Craft CMS version immediately to see if it is below 5.11.0.
- Review your GraphQL token permissions and rotate any tokens that have broader access than necessary.
- Monitor server logs for unexpected mutations or deletions across different site IDs.
- Plan to upgrade to version 5.11.0 or later once the vendor releases the update.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Craft CMS versions are vulnerable to this flaw?
Versions from 5.0.0 up to, but not including, 5.11.0 are affected by CVE-2026-112776.
What can an attacker do with this vulnerability?
Attackers can create, modify, or delete entries, categories, tags, and assets on other sites using a single token.
Is there a confirmed fix available yet?
No fix has been confirmed yet in the provided source material; users should wait for version 5.11.0 or later.
