CVE-2026-112776 | Craft CMS up to 5.10.x GraphQL requireAllowedSite siteId improper authorization

October 19, 2026 Yanac

A vulnerability was found in Craft CMS up to 5.10.x. It has been declared as critical. Impacted is the function requireAllowedSite of the component GraphQL. The manipulation of the argument siteId results in improper authorization.

This vulnerability is identified as CVE-2026-112776. The attack can be executed remotely. There is not any exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More