Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
CVE-2026-112776: Craft CMS GraphQL Bypass
TL;DR - CVE-2026-112776 affects Craft CMS 5.0.0 through 5.10.x. - The GraphQL authorization bypass may allow a holder of a site-scoped token to submit another site’s
siteId. - Depending on permissions and the mutation used, an attacker may create or delete content across sites. - Upgrade to Craft CMS 5.11.0 or later, review and rotate tokens, and investigate GraphQL activity. - No confirmed exploitation or public proof of concept is known, and the CVE is not listed in CISA KEV as of 2026-10-19.
Vulnerability at a Glance
CVE-2026-112776 is a critical authorization-bypass vulnerability in Craft CMS’s multi-site GraphQL functionality. The issue affects the Composer package craftcms/cms and is fixed in version 5.11.0.
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-112776 |
| CVSS score | 9.8 Critical |
| CVSS vector | Not included in the supplied NVD result; verify the vector directly in the NVD record |
| Attack vector | Network-based or remotely exploitable behavior is indicated by the score and description; confirm the exact vector before making vector-specific claims |
| Authentication required | Yes. The attacker needs a valid site-scoped GraphQL token or equivalent authorized GraphQL credential |
| Affected versions | >= 5.0.0, < 5.11.0 |
| Fixed version | 5.11.0 |
| Patch available | Yes |
| CISA KEV status | Not listed as of 2026-10-19 |
The vulnerability is most relevant to organizations using Craft CMS with multiple sites and GraphQL enabled. A token intended for one site may not remain confined to that site when certain mutations include a different siteId.
The practical risk is unauthorized cross-site content manipulation rather than anonymous unauthenticated access. An attacker must first obtain a valid token, but the missing authorization check can turn a limited credential into a cross-site administrative capability for specific content operations.
What Is CVE-2026-112776?
The root cause is failure to enforce Craft CMS’s requireAllowedSite() authorization check on affected GraphQL mutation paths. That check is intended to ensure that a token can operate only on sites included in its permitted scope. In vulnerable versions, certain mutations accept a caller-supplied siteId without consistently enforcing that site authorization boundary.
An attacker holding a token scoped to site A can therefore submit a mutation that identifies site B. Depending on the mutation and available permissions, the request may:
- Create entries in site B
- Delete entries
- Delete categories
- Delete tags
- Delete assets shared across sites
This is a cross-site authorization failure: the token is valid, but the requested target site is outside the token’s intended scope.
The vulnerability does not mean that every GraphQL request automatically grants access to every site. Exploitation depends on the attacker possessing a usable GraphQL token and the affected mutation path being available. Organizations should treat tokens with broad, unknown, or potentially exposed permissions as high-risk until they have been reviewed and rotated.
Who Is Affected?
The affected product is Craft CMS distributed through the Composer package craftcms/cms. The affected range is:
>= 5.0.0, < 5.11.0
This includes Craft CMS 5.0.0 through all 5.10.x releases. Craft CMS installations running 5.11.0 or later contain the vendor-provided fix identified in the supplied research.
The available information does not identify affected Craft CMS 4.x releases. Administrators should not assume that this CVE applies to other major versions without checking the vendor advisory and the installed package version.
Multi-site Craft CMS deployments with GraphQL enabled deserve priority review because the vulnerability crosses site boundaries. A single-site deployment may have less cross-site exposure, but it can still be affected if the vulnerable GraphQL functionality is reachable and the application uses site-scoped tokens.
Check the Installed Craft CMS Version
Identify the installed package version from the production deployment rather than relying only on an application banner or a development lockfile. Composer projects may declare a broad version constraint while composer.lock determines the version actually deployed.
composer show craftcms/cms --format=json
composer show craftcms/cms
Confirm the version running in production after deployment. Checking only composer.json is insufficient because the deployed version may be determined by the lockfile or by a separate build artifact.
CVSS Score Breakdown
NVD assigns CVE-2026-112776 a CVSS score of 9.8, classified as Critical. The supplied NVD result did not include the CVSS vector string, so a precise component-by-component interpretation should not be presented as authoritative until the vector is verified directly in the NVD record.
The available description supports several operational conclusions. The vulnerability is remotely reachable through GraphQL, requires an attacker to possess a valid site-scoped token, and can affect the confidentiality, integrity, and availability of content within the affected operations. Cross-site creation and deletion can cause material integrity and availability impact, particularly where assets or editorial content are shared across sites.
Administrators should distinguish the CVSS score from exploitability in their own environment. CVSS does not account for whether GraphQL is exposed externally, how tokens are issued and stored, whether destructive mutations are allowed, or whether monitoring would detect abuse. Those deployment factors should drive prioritization alongside the 9.8 severity rating.
Exploitation Status
No verified public proof-of-concept repository was identified in the supplied sources. There is also no confirmed in-the-wild exploitation report in the available research.
CISA’s Known Exploited Vulnerabilities catalog does not list CVE-2026-112776 as of 2026-10-19. Therefore, there is no CISA KEV due date or required-action entry for this CVE.
The absence of a KEV entry or public proof of concept is not evidence that exploitation is impossible. The attack requires a valid site-scoped GraphQL token, which means an attacker may need to compromise another system, recover credentials from logs or source code, exploit a separate application weakness, or abuse an overly broad token.
Defenders should prioritize remediation based on exposure and token sensitivity rather than waiting for confirmed exploitation.
Analyst’s Take: Patch affected installations first, then review and rotate site-scoped tokens based on their exposure and permissions. The lack of a public proof of concept or CISA KEV listing lowers the evidence of active exploitation, but it does not remove the risk created by a valid token and a reachable mutation path.
Treat tokens with unknown provenance or excessive site permissions as potentially compromised. If logs show cross-site mutations, unexpected deletions, or requests where the supplied siteId differs from the token’s assigned site, investigate the associated token and user activity immediately.
How to Detect CVE-2026-112776 Activity
Detection should combine application logs, GraphQL request telemetry, token inventory, and content audit history. The most useful signal is a mismatch between the site associated with a token and the siteId submitted in a mutation.
Exact log field names depend on Craft CMS logging configuration and the reverse proxy or application monitoring platform. Teams should validate patterns against their own telemetry.
Review for:
- Unexpected entry creation
- Entry deletion
- Category deletion
- Tag deletion
- Asset deletion
- Activity shortly after token creation or rotation
- Changes to GraphQL permissions
- Suspicious administrator logins
- Requests from unusual IP addresses
- Mutations where the requested
siteIddiffers from the token’s assigned site
Technical Detection Notes
If GraphQL request bodies are logged by an approved and privacy-conscious gateway, a conceptual search for cross-site mutation attempts can begin with a query such as:
service:"craft-cms"
path:"/api/graphql"
method:POST
body.siteId:*
body.mutation:*
For environments that normalize GraphQL operation names, use a query resembling:
path:"/api/graphql" AND method:"POST" AND
(operation:"createEntry" OR operation:"deleteEntry" OR
operation:"deleteCategory" OR operation:"deleteTag" OR
operation:"deleteAsset")
The following log pattern is a concrete investigation target, not a guaranteed Craft CMS native log format:
POST /api/graphql ... operation=deleteEntry siteId=site-b
token_site_scope=site-a
Do not store raw bearer tokens or GraphQL secrets in logs. Prefer a token identifier, hash, or redacted fingerprint. Compare the requested siteId with the token’s intended site scope from the token inventory, then correlate the request with content changes and administrative audit records.
For broader exposure-reduction measures, use a documented web application hardening checklist when reviewing endpoint access, secrets, logging, and administrative controls.
CVE-2026-112776 Mitigation and Patching
Upgrade every affected Craft CMS installation from 5.0.0 through 5.10.x to 5.11.0 or later. Before changing production, test the upgrade against the site’s plugins, custom modules, GraphQL schemas, deployment process, and database backup procedures.
Confirm the resulting deployed package version, not only the version declared in composer.json.
A typical Composer-based upgrade command is:
composer require craftcms/cms:"^5.11" --update-with-dependencies
Alternatively, update the project constraint and run:
composer update craftcms/cms --with-dependencies
composer show craftcms/cms
Use the project’s approved dependency-management and release process, and review the resulting composer.lock file before deployment. The fixed version identified for this CVE is 5.11.0; later 5.x releases should also contain the fix, subject to the vendor’s compatibility guidance.
Temporary GraphQL Exposure Reduction
If an immediate upgrade is not possible, temporarily restrict or disable externally accessible GraphQL functionality using the organization’s approved application or reverse-proxy controls. For example, a gateway can block the GraphQL endpoint for untrusted networks while allowing only known administrative or integration sources:
location = /api/graphql {
allow 192.0.2.0/24;
deny all;
proxy_pass http://craft_backend;
}
The endpoint path and access policy must be verified against the deployment. This is a temporary exposure-reduction measure, not a replacement for upgrading, and it may disrupt legitimate integrations.
Organizations reviewing centralized controls for cloud applications may also find it useful to compare CASB platforms and their access-control capabilities, although a CASB does not replace Craft CMS patching or token-level authorization checks.
Token Review and Rotation
Inventory all GraphQL tokens and confirm the sites and operations each token requires. Revoke or rotate tokens that may have been exposed.
Review the following locations for accidental token disclosure:
- Source repositories
- CI/CD logs
- Environment variables
- Browser storage
- Integration platforms
- Build artifacts
- Application and proxy logs
- Support tickets and shared documentation
Store replacement secrets in an approved secrets manager, such as 1Password, rather than in source code or unprotected configuration files. Do not place raw tokens in issue trackers, chat messages, or monitoring dashboards.
After patching:
- Confirm that every production instance runs Craft CMS 5.11.0 or later.
- Revoke unused and unknown GraphQL tokens.
- Rotate tokens with questionable exposure.
- Revalidate each token’s site and operation permissions.
- Review historical GraphQL mutations for cross-site
siteIdvalues. - Investigate unexpected content creation or deletion.
- Confirm that monitoring detects future site-scope mismatches.
Incident Response Considerations
If you identify suspicious cross-site GraphQL activity, preserve relevant evidence before making broad changes that could overwrite logs or audit records.
Collect:
- Redacted token identifiers
- GraphQL operation names
- Requested and expected site identifiers
- Source IP addresses
- User-agent information
- Authentication events
- Token creation and rotation timestamps
- Content audit records
- Web server and reverse-proxy logs
- Database or CMS backup snapshots
Rotate affected credentials after preserving the information needed for investigation. Assess whether an attacker could have accessed or modified content outside the intended site scope. Check for follow-on activity, including changes to users, permissions, integrations, webhooks, or other credentials.
If regulated, confidential, or business-critical content may have been accessed or altered, follow the organization’s incident-response and notification procedures.
References
The vendor-maintained GitHub Security Advisory is the primary reference for the vulnerability and remediation details:
The NVD record provides the CVE publication, severity information, affected range, and references:
The advisory reference supplied by NVD describes the affected Craft CMS GraphQL site-scope behavior:
For broader Craft CMS security and maintenance guidance, consult the vendor’s security information:
Before publishing vector-specific CVSS analysis or making claims about newly reported exploitation, verify the current NVD, vendor advisory, and CISA KEV records.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.