Description
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.0.0 – < 5.11.2 | 5.11.2 |
References
- GitHub Security Advisory (GHSA-mp59-9rf5-93wr) vendor-advisory
- VulnCheck Advisory: Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field third-party-advisory