A high-severity site scope bypass vulnerability in Craft CMS allows authenticated users to read, modify, or delete entries across unauthorized sites via GraphQL mutations.

This is an authorization bypass flaw (CWE-639) occurring within the GraphQL entry mutation resolvers. It requires an authenticated user to provide a manipulated siteId argument to ArgumentManager::prepareArguments(), which fails to validate the scope of the provided token against the requested site.

The ability for a low-privileged or site-scoped user to manipulate data across an entire CMS installation poses a significant threat to data integrity and confidentiality. With a CVSS score of 8.8, this flaw represents a high risk of unauthorized data modification or deletion, which could lead to severe operational disruption, loss of proprietary content, or compromise of multi-tenant site isolation.

Immediate Action: Update Craft CMS to version 5.10.11 or later to implement the necessary validation logic in the GraphQL mutation resolvers.

Proactive Monitoring: Review web server and application audit logs for unusual GraphQL mutation requests, specifically monitoring for unexpected siteId values originating from standard user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block GraphQL mutation requests that contain suspicious or unauthorized siteId parameters if immediate patching is not feasible.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized data manipulation across sites, organizations running Craft CMS versions 5.x must treat this as a high-priority security update. Administrators should verify their current version and apply the patch to 5.10.11 immediately to ensure proper authorization enforcement for all GraphQL entry operations.