CVE-2026-124426 | Craft CMS up to 5.11.1 GraphQL API /actions/graphql/api siteId authorization

A vulnerability was found in Craft CMS up to 5.11.1. It has been rated as problematic. This impacts an unknown function of the file /actions/graphql/api of the component GraphQL API. This manipulation of the argument siteId causes authorization bypass.

The identification of this vulnerability is CVE-2026-124426. It is possible to initiate the attack remotely. There is no exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More