CVE-2026-124426

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-124426
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-124426.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-124426
Aliases
  • GHSA-mp59-9rf5-93wr
Published
2026-11-08T13:15:23Z
Modified
2026-11-10T02:31:32Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field
Details

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/124xxx/CVE-2026-124426.json"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
f6a8fb685d44e387435825e3a96809eeda4973a6
Fixed
a29fe6f87bbba6453e9d488ab8a8145a8a9e4f96
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.0.0"
                },
                {
                    "fixed": "5.11.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "5.0.0"
                },
                {
                    "fixed": "5.11.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-124426.json"