Description

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T12:17:16.637Z",
  "pubdate": "2026-09-02T12:17:16.637Z",
  "executiveSummary": "This vulnerability is an Improper Access Control flaw within Craft CMS affecting native GraphQL user relation queries. It allows authenticated attackers with scoped GraphQL tokens to bypass intended user-group scope filters, leading to the unauthorized disclosure of sensitive user information.\nAffected systems include versions of Craft CMS prior to 5.11.0. The vulnerability allows an attacker to query protected relations, such as 'author', 'authors', 'uploader', 'draftCreator', and 'revisionCreator', to retrieve the usernames, email addresses, and full names of system users, including those with administrative privileges.\nThe risk implication is significant as it facilitates reconnaissance against the CMS user base, potentially enabling further targeted attacks such as credential harvesting or identity-based exploitation. Exploitation requires the attacker to possess a valid, albeit scoped, GraphQL API token. Once authenticated, the attacker can leverage the lack of server-side enforcement on relations to query data that should be restricted based on their token's defined scopes. This breach of data confidentiality represents a failure in the API's authorization layer, necessitating immediate patching of the core CMS framework.",
  "technicalDetails": "The vulnerability resides in the Craft CMS GraphQL implementation, specifically within the handling of native user-related fields. The root cause is a failure to apply user-group scope filters when resolving user relation fields in a GraphQL request. In a secure implementation, when a user queries relations like 'author' or 'uploader', the underlying resolver should inspect the security context of the requester to ensure they are authorized to view the requested user object based on the assigned token scope.\nIn the vulnerable versions, the resolver logic fails to validate the requester's scope against the target user record's metadata. When a request is made for content-related fields, the GraphQL engine fetches the related user object without performing an authorization check against the user's specific group-based permissions. This allows the API to return sensitive data fields—specifically email addresses, full names, and usernames—that are otherwise intended to be hidden from limited-access API consumers.\nThe attack flow proceeds as follows: First, an attacker obtains a scoped GraphQL API token. While the token is intended to limit access to specific endpoints or data types, the flaw allows the attacker to append native user relation fields to any legitimate GraphQL query. For example, an attacker can query a collection of entries and include the 'author' relation in their selection set. Because the filtering mechanism is absent, the CMS backend processes the request and populates the GraphQL response with the sensitive account details of the author, regardless of whether the attacker's scope should permit access to user information.\nThis exploitation does not require administrative access, only a valid GraphQL token, which may be obtainable in environments where public or low-privilege tokens are distributed for frontend integrations. The impact is a critical information disclosure, providing attackers with a comprehensive directory of the platform's user base, including high-privilege administrators. This exposure persists until the Craft CMS core is updated to version 5.11.0 or later, where the resolver logic is correctly patched to enforce the necessary authorization checks on these user-relation fields."
}