CVE-2026-72784 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS instances, security teams monitoring for suspicious activity, and developers integrating GraphQL functionality should assess exposure and prioritize remediation.

Why it matters

CVE-2026-72784 is a server-side request forgery vulnerability in Craft CMS that allows attackers to disclose internal content, force outbound requests, and enumerate internal services. Defenders should prioritize verifying exposure, restricting GraphQL token permissions, and monitoring for suspicious requests.

• Disclosure of internal HTTP content
• Forced outbound GET requests to internal hosts
• Enumeration of internal services
• Verification of affected versions and exposure

Technical summary

The vulnerability exists in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side without proper anti-SSRF validation. This allows attackers to disclose internal HTTP content, force outbound GET requests to internal hosts, and enumerate internal services. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can exploit this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of Craft CMS instances to untrusted networks, restricting GraphQL token permissions, and monitoring for suspicious outbound requests.

Recommended defensive actions

• Verify exposure of Craft CMS instances to untrusted networks
• Restrict GraphQL token permissions to minimize attack surface
• Monitor for suspicious outbound requests from Craft CMS instances
• Apply vendor-provided patches or updates to affected versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and potential impacts. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.