VYPR
patchPublished Sep 2, 2026· Updated Sep 3, 2026· 1 source

Craft CMS: 14 Vulnerabilities Disclosed, Including Critical Auth Bypass and GraphQL Flaws

Key findings • 14 Craft CMS vulnerabilities disclosed on September 2, 2026, ranging from Medium to Critical severity. • Multiple flaws in GraphQL API allow unauthorized site access and data m…

Key findings

  • 14 Craft CMS vulnerabilities disclosed on September 2, 2026, ranging from Medium to Critical severity.
  • Multiple flaws in GraphQL API allow unauthorized site access and data manipulation.
  • Critical vulnerability enables privilege escalation to administrator level via user registration.
  • Admin accounts vulnerable to takeover through flawed password reset mechanism.
  • Stored XSS in site name field and asset management abuse also disclosed.
  • All vulnerabilities addressed in Craft CMS version 5.10.11.

On September 2, 2026, a batch of 14 vulnerabilities was disclosed for Craft CMS, impacting various versions of the content management system. These vulnerabilities, disclosed within a three-hour window, range in severity from Medium to Critical, with several High-severity flaws allowing for unauthorized data access, modification, and deletion. The disclosures highlight issues primarily related to authorization bypass, improper access control, and insufficient input validation within the CMS's core functionalities, including its GraphQL API and asset management features.

Several vulnerabilities stem from improper handling of site IDs and permissions within the GraphQL API. CVE-2026-79991 and CVE-2026-79990 describe how GraphQL entry mutation resolvers (saveEntry, deleteEntry) directly read siteId from arguments without proper validation, bypassing site-scope filtering. Similarly, CVE-2026-84796 details a site scope bypass in GraphQL entry mutation resolvers, allowing attackers with site-specific tokens to affect entries across unauthorized sites. Additionally, CVE-2026-84799 points to a failure in enforcing user-group scope filters on native GraphQL user relations, potentially exposing usernames, email addresses, and full names of content authors.

Other significant vulnerabilities include authentication and authorization bypasses. CVE-2026-84795, a Critical severity flaw, allows attackers to inherit administrator privileges by registering with a deactivated admin's email address under specific conditions. CVE-2026-84801, a High severity vulnerability, enables non-admin users with Edit users permission to mint password reset URLs for administrator accounts, facilitating account takeover. CVE-2026-84793 describes a stored cross-site scripting (XSS) vulnerability in the site name field, allowing administrators to inject malicious JavaScript payloads that execute when other users view control panel settings.

The disclosures also cover issues within the asset management system. CVE-2026-84800 and CVE-2026-84794 detail missing authorization checks in asset controllers, enabling authenticated users to replace or move assets into unauthorized locations, potentially leading to data overwrites and unauthorized deletion. CVE-2026-84802 highlights an information disclosure vulnerability in the AssetsController::actionMoveInfo endpoint, allowing authenticated users to retrieve asset counts and total sizes for any folder, irrespective of their permissions.

Craft CMS addressed these vulnerabilities in version 5.10.11 and later releases. Users are strongly advised to update to the latest available version to mitigate these risks. The broad range of vulnerabilities, affecting critical functions like user management, content editing, and asset handling, underscores the importance of timely patching and security audits for Craft CMS installations.

The batch of vulnerabilities disclosed on September 2, 2026, for Craft CMS presents a significant security challenge for its users. The concentration of high and critical severity flaws, particularly those affecting authentication, authorization, and site scope validation, necessitates immediate attention from administrators. The fixes, consolidated in version 5.10.11, provide a comprehensive solution to these disclosed issues, emphasizing the vendor's commitment to addressing security concerns. Users should prioritize updating their installations to prevent potential exploitation of these weaknesses.

Key vulnerabilities include:

  • GraphQL API Exploitation: Flaws in GraphQL resolvers allowed unauthorized site access and data manipulation (CVE-2026-79991, CVE-2026-79990, CVE-2026-84796).
  • Privilege Escalation: A critical vulnerability enabled attackers to gain administrator privileges via user registration (CVE-2026-84795).
  • Account Takeover: Non-admins could reset admin passwords due to a validation flaw in password reset functionality (CVE-2026-84801).
  • Stored XSS: A stored XSS vulnerability in the site name field allowed for JavaScript injection (CVE-2026-84793).
  • Asset Management Abuse: Missing authorization checks in asset controllers enabled unauthorized asset replacement and deletion (CVE-2026-84800, CVE-2026-84794).
  • Information Disclosure: An information disclosure vulnerability in asset move operations exposed sensitive asset counts and sizes (CVE-2026-84802).

The vulnerabilities were patched in Craft CMS version 5.10.11.

CVE-2026-79991, CVE-2026-79990, CVE-2026-79989, CVE-2026-84802, CVE-2026-84801, CVE-2026-84800, CVE-2026-84799, CVE-2026-84798, CVE-2026-84797, CVE-2026-84796, CVE-2026-84795, CVE-2026-84794, CVE-2026-84793, CVE-2026-84792

Synthesized by Vypr AI