Uncle_Cui233

**Name of the Vulnerable Software and Affected Versions** Craft CMS (affected versions not specified) **Description** GraphQL entry mutation resolvers `saveEntry()` and `deleteEntry()` read the `siteId` directly from `$arguments` without using the `ArgumentManagerprepareArguments()` function. This function is responsible for enforcing site-scope filtering by using `array intersect` against the allowed sites in the GraphQL schema. While the query path `ElementResolverprepareElementQuery()` correctly implements this check, mutations bypass it. Consequently, an attacker with a token scoped to one site can create, modify, or delete entries in another site by providing a different `siteId` in the mutation arguments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.