Is CVE-2026-84796 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84796?

CVE-2026-84796 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-84796

Description

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.