CVE-2026-124426Medium· 5.3▾ SunlitCraft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/grap…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.
cms >= 5.0.0 < 5.11.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56384Medium· 4.3Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
CVE-2026-124427Critical· 9.8Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next
CVE-2026-124431Medium· 4.3Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement
CVE-2026-109306Medium· 5.9Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition
CVE-2026-92589Medium· 4.3Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint
CVE-2026-86731Medium· 6.5Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action)