CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.11 are vulnerable to a site scope bypass in GraphQL entry mutation resolvers, allowing attackers with limited access tokens to manipulate data across unauthorized sites by exploiting improper validation of the siteId parameter. This vulnerability poses a significant risk, as it enables unauthorized reading, modification, or deletion of entries. Organizations using affected versions should prioritize immediate updates to mitigate potential data breaches and maintain the integrity of their content management systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.