A high-severity authorization bypass vulnerability in Craft CMS allows authenticated attackers to perform unauthorized cross-site content manipulation, including reading, updating, and deleting entries.

The GraphQL entry mutation resolvers (saveEntry and deleteEntry) fail to pass the siteId argument through the required security validation function, prepareArguments. This oversight allows an authenticated user with limited site-specific access to bypass scope restrictions and manipulate data in unauthorized sites.

The ability to manipulate content across sites poses a significant risk to data integrity and confidentiality. Attackers can exfiltrate sensitive information from restricted site segments or cause widespread service disruption by deleting global entries. With a CVSS score of 8.7, this flaw represents a critical threat to multi-site installations where strict administrative boundaries are required for compliance and operational security.

Immediate Action: Update Craft CMS to version 5.10.11 or later immediately to apply the necessary security patches to the GraphQL mutation resolvers.

Proactive Monitoring: Review GraphQL access logs for unusual mutation activity, specifically focusing on requests where the siteId parameter references sites outside the scope of the authenticated user.

Compensating Controls: If immediate patching is not feasible, restrict access to the GraphQL endpoint at the Web Application Firewall (WAF) level for all untrusted or low-privilege user accounts.

Public Exploit Available: No (exploit_available: unknown)

Given the ease with which an authenticated attacker can bypass site-level authorization, organizations running multi-site Craft CMS instances must prioritize this update. Applying the patch is the only definitive way to restore proper site-scope filtering and prevent unauthorized cross-site data manipulation.