Craft CMS: Batch of Five Vulnerabilities Includes Two High-Severity Flaws
Craft CMS addresses five vulnerabilities, including two High-severity flaws in GraphQL authorization and an incomplete fix for a previous issue, disclosed on September 16, 2026.
Key findings
- Five Craft CMS vulnerabilities disclosed on September 16, 2026, with three rated High severity.
- CVE-2026-92593 (High) involves an incomplete fix leading to an unsandboxed sink and a self-signing oracle.
- CVE-2026-92594 (High) misconfigures authorization for GraphQL draft and revision creation fields.
- Medium severity flaws include an installer reachability issue (CVE-2026-92591), stored XSS in Generated Fields (CVE-2026-92590), and broken access control in element reordering (CVE-2026-92589).
- Affected versions range from 5.0.0-RC1 up to 5.10.12, with patches available in versions 5.10.13 and 5.11.0.
On September 16, 2026, a batch of five vulnerabilities was disclosed for Craft CMS, with three of the five rated as High severity. These vulnerabilities, disclosed on the same day, impact various aspects of the CMS, including authorization, input sanitization, and access control.
One of the high-severity vulnerabilities, CVE-2026-92593 (CVSSv3 8.8), stems from an incomplete fix for a previous vulnerability (CVE-2026-55794). This issue affects Craft CMS versions 5.10.0 through 5.10.12. The vulnerability lies in the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink, which remained unsandboxed. Additionally, the same fix introduced a self-signing oracle in Cp::elementLabelHtml(). The vulnerability arises because Craft/Yii HMAC tokens are not bound to a parameter.
Another high-severity vulnerability, CVE-2026-92594 (CVSSv3 7.5), concerns incorrect authorization for the GraphQL draftCreator and revisionCreator fields. Versions from Craft CMS 5.0.0-RC1 up to, but not including, 5.11.0 incorrectly authorize these fields. Instead of enforcing the user-data scope required by Gql::canQueryUsers() (usergroups.*:read), these fields are only gated by the elements.drafts:read / elements.revisions:read scopes.
The remaining three vulnerabilities are rated as Medium severity. CVE-2026-92591 (CVSSv3 5.9) affects Craft CMS versions 5.0.0 through 5.10.12. In this scenario, a database connection failure is treated as Craft not being installed, making anonymous installer actions, such as install/validate-site, accessible on an installed production site if PHP is available but the MySQL endpoint is not. The action accepts a site URL and a database schema name.
CVE-2026-92590 (CVSSv3 5.4) is a stored cross-site scripting (XSS) vulnerability present in versions 5.7.0 before 5.10.13. This flaw occurs in the Generated Fields feature, where Twig autoescaping is disabled and cached values are not encoded. Content editors can inject malicious JavaScript into editable fields, which then executes within the sessions of authenticated Control Panel users.
Finally, CVE-2026-92589 (CVSSv3 4.3) is a broken access control flaw in the nested-elements reorder endpoint, affecting Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13). When an authenticated Control Panel user with viewEntries and viewPeerEntries permissions (but lacking savePeerEntries) opens another author's entry in read-only mode, Craft grants access to the reorder endpoint unconditionally.
These vulnerabilities highlight potential weaknesses in authorization, sanitization, and access control within Craft CMS. Users are advised to update to the latest patched versions to mitigate these risks. The disclosure of these CVEs on a single day suggests a coordinated effort to address these security concerns by the Craft CMS security team.
Affected Versions and Patches
- **CVE-2026-92594**: Fixed in Craft CMS 5.11.0.
- **CVE-2026-92593**: Affects versions 5.10.0 through 5.10.12. The fix was applied in a subsequent release.
- **CVE-2026-92591**: Affects versions 5.0.0 through 5.10.12.
- **CVE-2026-92590**: Affects versions 5.7.0 before 5.10.13. Fixed in 5.10.13.
- **CVE-2026-92589**: Affects versions 5.0.0 through 5.10.12. Fixed in 5.10.13.
Users should ensure they are running versions that include these fixes to protect their Craft CMS installations. The timely disclosure and patching of these issues are crucial for maintaining the security posture of websites built on Craft CMS.