CVE-2026-124426

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.11.1

Description An authorization bypass allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. This is achieved by sending a POST request to the '/actions/graphql/api' endpoint and selecting the localized field without providing the siteId argument, leading to the disclosure of out-of-scope site content.

Recommendations Update Craft CMS to version 5.11.2 or later.