CVE-2026-84796: Craft CMS CMS

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.

Affected products

• Craft CMS CMS: from 5.0.0-RC1, before 5.10.11 (fixed in 5.10.11)

Published 2026-09-02. Last modified 2026-09-02.