These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-92594 is a high-severity vulnerability in Craft CMS, allowing unauthorized disclosure of personal identifiable information (PII) via the GraphQL API. The issue exists in versions 5.0.0-RC1 through 5.10.0 and is fixed in version 5.11.0. This vulnerability enables an attacker to harvest sensitive information, including email addresses, usernames, full names, and postal addresses of draft/revision c [truncated]
CVE-2026-92590 is a stored cross-site scripting vulnerability in Craft CMS versions from 5.7.0 before 5.10.13. The vulnerability is located in the Generated Fields feature, which disables Twig autoescaping and fails to encode cached values. This allows content editors to inject malicious JavaScript through editable fields, which executes in authenticated Control Panel sessions of higher-privileged users v [truncated]
CVE-2026-92589 is a broken access control vulnerability in Craft CMS 5.0.0 through 5.10.12, fixed in 5.10.13. An authenticated control panel user with view-only access can reorder Matrix blocks or Addresses for content they are denied save access to. This issue allows unauthorized modification of content, potentially impacting data integrity. Defenders should prioritize verifying exposure and applying the [truncated]
CVE-2026-86731 is a permission escalation vulnerability in Craft CMS versions 5.0.0-RC1 through 5.10.11. An authenticated control panel user with the administrateUsers permission, but not administrator privileges, can activate a pending or deactivated administrator account. This issue is fixed in Craft CMS 5.10.12. The vulnerability allows for permission escalation when combined with resetting the account [truncated]
PatchSiren debrief for CVE-2026-79991 based on the supplied source corpus. The vulnerability affects Craft CMS, specifically the GraphQL entry mutation resolvers (saveEntry, deleteEntry), which improperly handle siteId, bypassing site-scope filtering. This allows unauthorized modifications across sites. Users should review and apply patches to prevent such issues.
PatchSiren debrief based on CVE-2026-79990 from the supplied source corpus. The CVE record was published on 2026-09-02T15:17:42.473Z and was last modified on 2026-09-03T17:45:20.840Z. The NVD entry is currently Deferred. Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) bypass site-scope filtering, allowing unauthorized site access. This occurs because the resolvers read siteId directly [truncated]
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators. This vulnerability could lead to potential information [truncated]
Craft CMS versions before 5.10.11 have a high-severity vulnerability (CVSS Score: 7.1) due to lack of authorization checks in the assets/move-asset endpoint. This allows authenticated users without peer asset permissions to move assets into other users' folders and force deletion of conflicting files, enabling unauthorized asset deletion and replacement. Organizations should prioritize patching to prevent [truncated]
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated [truncated]
CVE-2026-72786 is an authentication bypass vulnerability in Craft CMS versions before 5.10.8. The vulnerability exists in the elements/save action and allows authenticated users with edit users permission to change passwords without verification. This could lead to unauthorized password resets for any user, including administrators. Administrators and users of Craft CMS versions before 5.10.8, especially [truncated]
CVE-2026-72784 is a server-side request forgery vulnerability in Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2. This vulnerability allows an attacker with a GraphQL token scoped only to asset-creation permissions to disclose internal HTTP content, force outbound GET requests to internal hosts, and enumerate internal services. The vulnerability exists in the GraphQL save<Volu [truncated]
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The weakness arises from the order of operations, where path validation occurs before normalization, potentially allowing paths to be normalized to locations outside the intended volume directory. This issue is note [truncated]
CVE-2026-72782 is a high-severity vulnerability (CVSS 7.1) in Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2. The vulnerability allows authenticated attackers with control panel access to interpolate environment variables and secrets into Twig templates, even when the Twig sandbox is enabled. Using a blind error-based technique across multiple requests, attackers can incremen [truncated]
CVE-2026-72781 is a remote code execution vulnerability in Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3. The vulnerability is located in the Twig sandbox mechanism. An authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii base Component arbitrary function-call gadget to execute arbitrary code.
Craft CMS before 5.10.5 is vulnerable to an authentication bypass due to a failure in persisting updated credential counters after WebAuthn assertion validation in the passkey login endpoint. This allows attackers to replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts. Organizations should verify their Craft CMS versio [truncated]
CVE-2026-72779 is a high-severity vulnerability in Craft CMS that allows an authenticated administrator to read arbitrary files on the server. The vulnerability exists in Craft CMS versions 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2. An attacker can exploit this vulnerability by configuring a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template cont [truncated]
PatchSiren debrief of CVE-2026-72778, an authenticated remote code execution vulnerability in Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6. This vulnerability allows an attacker with an authenticated control panel session and valid CSRF token to execute operating system commands as the PHP/web user due to improper cleansing of request-controlled condition arrays in the [truncated]
CVE-2026-56394 is a HIGH-severity vulnerability in Craft CMS, a content management system. An authenticated path traversal vulnerability exists in the assets/icon endpoint, where the extension parameter is not validated before file existence checks. This allows attackers to bypass extension validation by passing traversal sequences that resolve to existing SVG files, potentially leading to local file read [truncated]
CVE-2026-56393 is a medium-severity vulnerability affecting Craft CMS versions 4.x and 5.x. An authenticated administrator can inject malicious payloads into various settings, leading to arbitrary JavaScript execution in other users' control-panel sessions. The vulnerability is fixed in Craft CMS 4.17.0-beta.1 and 5.9.0-beta.1. Defenders should prioritize patching due to the potential for code execution.
CVE-2026-56385 is a medium-severity authorization bypass vulnerability in Craft CMS. The vulnerability affects Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7. An authenticated low-privileged user can exploit this vulnerability to view private assets by supplying a controlled assetId. The vulnerability has been fixed in Craft CMS versions 5.9.14 and 4.17.8. Defenders should prioriti [truncated]
CVE-2026-56384 is a missing authorization vulnerability in Craft CMS, affecting versions 4.0.0-RC1 to 4.17.7 and 5.0.0-RC1 to 5.9.13. This vulnerability allows a Control Panel user without permission to view a target private asset to call the assets/preview-thumb endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset [truncated]
CVE-2026-56383 is a stored cross-site scripting (XSS) vulnerability in Craft CMS, specifically in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page [truncated]
CVE-2026-56382 is a high-severity remote code execution vulnerability in Craft CMS versions >= 5.5.0 and <= 5.9.13. The vulnerability exists in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without proper sanitization. An authenticated admin user can inject Yii2 event handlers to execute arbitrary PHP code and d [truncated]
CVE-2026-56381 is a stored cross-site scripting (XSS) vulnerability in Craft CMS, affecting versions 5.0.0-RC1 and later. The vulnerability exists in the User Permissions page, where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field, which executes when other users view or edit permissions. The CVSS score f [truncated]
The Craft CMS preview token endpoint is vulnerable to CSRF attacks, allowing an attacker to force a logged-in victim editor to mint a preview token chosen by the attacker. This token can then be used to access previewed/unpublished content tied to the victim's authorized preview scope. The vulnerability is fixed in Craft CMS versions 4.17.3 and 5.9.7. Defenders and administrators of Craft CMS installation [truncated]