Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers. The flaw exists because siteId is not validated through ArgumentManager::prepareArguments() in GraphQL entry mutation resolvers. Attackers holding tokens scoped to a single site can exploit this by passing siteId directly in mutation arguments. This allows unauthorized read, modification, or deletion of entries across other sites within the same Craft CMS installation. The vulnerability poses a significant risk to multi-site Craft CMS deployments where data isolation between sites is critical. It has been assigned CVE-2026-84796 and is documented in a GitHub security advisory. Users are strongly advised to upgrade to Craft CMS version 5.10.11 or later to remediate the issue.