CVE-2026-79990 craftcms CVE debrief

Who should care

Users of Craft CMS, especially those with multiple sites, should review and apply patches to prevent unauthorized access. Affected operators and platforms should assess their exposure and consider immediate defensive review due to the HIGH CVSS score of 8.7. Vulnerability management and security teams should prioritize this issue and ensure that compensating controls are in place for exposed systems.

Technical summary

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) bypass site-scope filtering, allowing unauthorized site access. This occurs because the resolvers read siteId directly from $arguments without passing through ArgumentManager prepareArguments(), which enforces site-scope filtering via array_intersect against the GraphQL schema's allowed sites. While the query path correctly calls prepareArguments(), mutations bypass this entirely. An attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument. This issue allows for unauthorized access across multiple sites within a Craft CMS deployment.

Defensive priority

CVE-2026-79990 is rated HIGH with a CVSS score of 8.7. Consider immediate defensive review.

Recommended defensive actions

• Review and apply vendor patches or updates
• Verify site-scope filtering implementation
• Monitor for unauthorized mutations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; verify with official records. Site-scope filtering bypass in Craft CMS GraphQL entry mutation resolvers. Affected product deployments should be reviewed for exposure. Defenders should verify official advisories and consider immediate defensive review due to HIGH CVSS score of 8.7. Additional verification tasks are recommended to ensure accurate affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.