CyberRota Analysis
AI-GeneratedCraft CMS versions 5.0.0-RC1 through 5.10.9 have a vulnerability in the GraphQL API that improperly authorizes access to sensitive user information, allowing clients with limited permissions, including unauthenticated users, to retrieve email addresses, usernames, full names, and postal addresses of draft and revision creators. This poses a significant risk of data exposure, particularly for site editors and administrators. Organizations using affected versions should prioritize upgrading to 5.11.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.