https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T10:57:21.680967+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-112776 fkie_cve-2026-112776 2026-10-20T10:57:21.707133+00:00

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

 https://db.gcve.eu/vuln/ghsa-vgpq-xf77-c94c GHSA-vgpq-xf77-c94c 2026-10-20T10:57:21.707278+00:00

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.