CVE-2026-92594 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS instances, particularly those with public GraphQL schemas enabled, should assess exposure and apply the patch to prevent unauthorized disclosure of sensitive information.

Why it matters

CVE-2026-92594 is a high-severity vulnerability in Craft CMS that allows unauthorized disclosure of personal identifiable information (PII) via the GraphQL API. Defenders should prioritize verifying exposure and applying the patch to prevent potential exploitation and unauthorized disclosure of sensitive information.

• Potential unauthorized disclosure of sensitive information (email addresses, usernames, full names, and postal addresses) of draft/revision creators.
• Possible exploitation by unauthenticated clients when the public GraphQL schema is enabled with the drafts or revisions scope.
• Verification priority for exposure and patch application to prevent potential exploitation.
• Potential impact on site editors and administrators who typically create drafts and revisions.

Technical summary

The vulnerability exists in the GraphQL draftCreator and revisionCreator fields, which are not properly authorized, allowing a client with only the drafts or revisions scope to harvest PII of draft/revision creators. This issue arises because these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, rather than requiring the user-data scope enforced by Gql::canQueryUsers(). As a result, an attacker can obtain sensitive information such as email addresses, usernames, full names, and postal addresses of draft/revision creators. The issue is fixed in Craft CMS version 5.11.0.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as exploitation could lead to unauthorized disclosure of sensitive information.

Recommended defensive actions

• Verify exposure by checking if the Craft CMS instance is running a vulnerable version (5.0.0-RC1 to 5.10.0) and if the public GraphQL schema is enabled with the drafts or revisions scope.
• Apply the patch by upgrading to Craft CMS version 5.11.0 or later.
• Review and restrict GraphQL API access to ensure that only authorized users have the necessary scopes to query user data.
• Monitor for potential exploitation attempts and implement additional security measures to protect sensitive information.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from the Craft CMS security advisory and Vulncheck's advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.