CVE-2026-79991 craftcms CVE debrief

Who should care

Users of Craft CMS, especially those with multiple sites, should review and apply patches to prevent unauthorized modifications. Site administrators and security teams managing Craft CMS installations should prioritize patching and monitor for suspicious activity. Additionally, developers integrating with Craft CMS GraphQL should verify site-scope filtering in their applications.

Technical summary

The Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from $arguments without passing through ArgumentManager prepareArguments(), bypassing site-scope filtering. This allows an attacker with a token scoped to Site A to create, modify, or delete entries in Site B by passing siteId in the mutations argument. The query path correctly calls prepareArguments(), but mutations do not, leading to potential unauthorized modifications.

Defensive priority

High priority due to high CVSS score of 7.1 and potential for unauthorized site modifications.

Recommended defensive actions

• Review and apply patches from Craft CMS
• Restrict access to GraphQL mutation resolvers
• Monitor for unauthorized site modifications
• Verify site-scope filtering via ArgumentManager
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the official CVE Program record and NIST NVD detail page supports the vulnerability details. However, some source details are limited, and further verification is needed to confirm affected scope and vendor guidance. Defenders should verify site configurations, review compensating controls, and monitor for unauthorized site modifications.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.