Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.

Craft CMS versions prior to 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers. The flaw exists because siteId is not properly validated through ArgumentManager::prepareArguments(). Attackers holding tokens scoped to a single site can exploit this to read, modify, or delete entries belonging to other unauthorized sites by injecting siteId directly into mutation arguments. This represents a significant authorization control failure within the GraphQL API layer. The vulnerability affects multi-site Craft CMS installations where GraphQL tokens are used for scoped access control. Successful exploitation could lead to unauthorized data access or data tampering across site boundaries. A fix is available in Craft CMS version 5.10.11 and later.