CVE-2026-79991

Name of the Vulnerable Software and Affected Versions Craft CMS (affected versions not specified)

Description GraphQL entry mutation resolvers saveEntry() and deleteEntry() read the siteId directly from $arguments without using the ArgumentManagerprepareArguments() function. This function is responsible for enforcing site-scope filtering by using array intersect against the allowed sites in the GraphQL schema. While the query path ElementResolverprepareElementQuery() correctly implements this check, mutations bypass it. Consequently, an attacker with a token scoped to one site can create, modify, or delete entries in another site by providing a different siteId in the mutation arguments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.