CVE-2026-84799
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.17%
- CWE
- CWE-285
- Published
- 2026-09-02
- Last modified
- 2026-09-04
Affected products
- craftcms cms
- craftcms cms
Weakness type
Related vulnerabilities
- CVE-2026-86804 — seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
- CVE-2026-58611 — Xbox Gaming Services Elevation of Privilege Vulnerability
- CVE-2026-86277 — SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization
- CVE-2026-86263 — sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization
- CVE-2026-86262 — sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization
- CVE-2026-86261 — sfturing hosp_order Order Controller OrderController.java authorization
- CVE-2026-86283 — MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
- CVE-2026-86212 — Open5GS AMF/MME improper authorization