Summary
Craft CMS contains an authorization bypass in site-scoped GraphQL tokens, allowing a token intended for one site to modify content belonging to another site. The issue becomes risky when GraphQL access is enabled and an attacker possesses a valid token with mutation capabilities.
Craft CMS contains an authorization bypass in site-scoped GraphQL tokens, allowing a token intended for one site to modify content belonging to another site. The issue becomes risky when GraphQL access is enabled and an attacker possesses a valid token with mutation capabilities.
Affected context
The vulnerability affects Craft CMS installations using GraphQL tokens that are intended to be restricted to a particular site. In affected deployments, site authorization checks may not be consistently enforced for mutations, allowing supplied site context to influence operations across sites. The impact depends on token permissions and whether multiple sites share content resources.
The vulnerability affects Craft CMS installations using GraphQL tokens that are intended to be restricted to a particular site. In affected deployments, site authorization checks may not be consistently enforced for mutations, allowing supplied site context to influence operations across sites. The impact depends on token permissions and whether multiple sites share content resources.
Exploit preconditions
- Attack surface: Craft CMS GraphQL mutation functionality
- Required access: A valid site-scoped GraphQL token with sufficient mutation permissions
- Trigger point: A content mutation that accepts or processes a site identifier
- Why exploitation is possible: The expected site-authorization check is not enforced consistently, allowing operations to target another site or shared content
- Attack surface: Craft CMS GraphQL mutation functionality
- Required access: A valid site-scoped GraphQL token with sufficient mutation permissions
- Trigger point: A content mutation that accepts or processes a site identifier
- Why exploitation is possible: The expected site-authorization check is not enforced consistently, allowing operations to target another site or shared content
Why this happens
The underlying bug is an authorization enforcement failure mapped to CWE-863: Incorrect Authorization. Craft CMS accepts a site-scoped token but does not reliably apply the token's allowed-site restriction before performing GraphQL mutations. This creates a mismatch between authenticated identity, token scope, and the authorization decision for the requested resource.
The underlying bug is an authorization enforcement failure mapped to CWE-863: Incorrect Authorization. Craft CMS accepts a site-scoped token but does not reliably apply the token's allowed-site restriction before performing GraphQL mutations. This creates a mismatch between authenticated identity, token scope, and the authorization decision for the requested resource.
Potential impact
- An attacker may create entries in another site
- An attacker could delete entries, categories, tags, or assets
- Content integrity across multiple sites may be compromised
- Site-specific access boundaries can be bypassed
- The incident may cause data loss, defacement, or operational disruption
- An attacker may create entries in another site
- An attacker could delete entries, categories, tags, or assets
- Content integrity across multiple sites may be compromised
- Site-specific access boundaries can be bypassed
- The incident may cause data loss, defacement, or operational disruption
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every mutation
boundary and treating client-supplied site identifiers as untrusted.
Common defensive patterns include:
- Enforcing token site scope server-side for every read and mutation operation
- Deriving the effective site from trusted authorization context rather than accepting it solely from requests
- Applying object-level authorization checks to entries, categories, tags, and assets
- Using least-privilege GraphQL tokens with only the permissions and sites required
- Restricting or disabling GraphQL mutations when they are not needed
- Auditing shared-resource behavior to ensure cross-site operations follow explicit policy
Mitigation generally focuses on enforcing authorization at every mutation
boundary and treating client-supplied site identifiers as untrusted.
Common defensive patterns include:
- Enforcing token site scope server-side for every read and mutation operation
- Deriving the effective site from trusted authorization context rather than accepting it solely from requests
- Applying object-level authorization checks to entries, categories, tags, and assets
- Using least-privilege GraphQL tokens with only the permissions and sites required
- Restricting or disabling GraphQL mutations when they are not needed
- Auditing shared-resource behavior to ensure cross-site operations follow explicit policy
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis and code review checks confirming authorization helpers are invoked on every site-sensitive mutation path
- Tests that attempt cross-site operations using tokens scoped to a single site
- Regression tests covering creation and deletion of entries, categories, tags, and assets
- GraphQL audit-log analysis for mutations whose requested site differs from the token's permitted site
- Policy enforcement requiring object-level authorization before any state-changing operation
- Automated security review tools that identify client-controlled authorization parameters and missing permission checks
Organizations can look for this issue through:
- Static analysis and code review checks confirming authorization helpers are invoked on every site-sensitive mutation path
- Tests that attempt cross-site operations using tokens scoped to a single site
- Regression tests covering creation and deletion of entries, categories, tags, and assets
- GraphQL audit-log analysis for mutations whose requested site differs from the token's permitted site
- Policy enforcement requiring object-level authorization before any state-changing operation
- Automated security review tools that identify client-controlled authorization parameters and missing permission checks
