VulnSocial

CVE-2026-112776

LOWCVSS 9.3 · CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • ThreatAft@ThreatAft

    🔐Full breakdown — all 8 CVEs, the ATO→RCE chain, and what 4.x vs 5.x operators actually need to do: https://threataft.com/articles/craft-cms-cve-2026-112776-graphql-twig-sandbox-rce #CraftCMS #CVE #AppSec #Vulnerability

    0001041
    51 followersView on X

Explore more

Back to dashboard