CVE-2026-84796

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 5.10.11

Description GraphQL entry mutation resolvers fail to validate the siteId through the prepareArguments() function in the ArgumentManager class. This allows an attacker using a token scoped to a specific site to bypass site scoping by passing a different siteId directly in mutation arguments, enabling the unauthorized reading, modification, or deletion of entries across other sites.

Recommendations Update to version 5.10.11.