CVE-2026-79990

Name of the Vulnerable Software and Affected Versions Craft CMS (affected versions not specified)

Description GraphQL entry mutation resolvers saveEntry() and deleteEntry() read the siteId variable directly from $arguments without utilizing the ArgumentManagerprepareArguments() function. This function is responsible for enforcing site-scope filtering by using array intersect against the allowed sites defined in the GraphQL schema. While the query path ElementResolverprepareElementQuery() correctly implements this check, mutations bypass it. Consequently, an attacker with a token scoped to one site can create, modify, or delete entries in another site by providing a different siteId in the mutation arguments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.