CVE-2026-124426

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 8, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1244279.8Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scopeCVE-2026-1244286.5Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG fCVE-2026-1244297.5Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim dCVE-2026-124438.8Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafCVE-2026-1244308.8Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtaCVE-2026-1244314.3Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse CVE-2026-1244327.3phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated CVE-2026-1244336.5phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE pCVE-2026-1244347.1Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values CVE-2026-1244354.8OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions tCVE-2026-1244368.0OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resouCVE-2026-1244377.5Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because b
CVE-2026-124426: Medium severity, CVSS 5.3 | Vulnix