CVE-2026-44010

Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.

CVSS

No CVSS.

References

Link	Resource
https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128
https://github.com/craftcms/cms/security/advisories/GHSA-gj2p-p9m4-c8gw
https://github.com/craftcms/cms/security/advisories/GHSA-gj2p-p9m4-c8gw

Configurations

No configuration.

History

26 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Craft CMS es un sistema de gestión de contenido (CMS). Desde 4.0.0 hasta antes de 4.17.12 y 5.9.18, el resolvedor de elementos GraphQL Address (src/gql/resolvers/elements/Address.php) no realiza filtrado de alcance de esquema en consultas de nivel superior. Un token de API GraphQL con alcance a un único grupo de usuarios de bajo privilegio puede leer cada dirección en el sistema, incluyendo direcciones pertenecientes a usuarios en grupos a los que el token no tiene autorización para acceder. Esto expone PII, incluyendo nombres completos, direcciones, organizaciones, números de identificación fiscal, etc. Esta vulnerabilidad está corregida en 4.17.12 y 5.9.18.

Information

Published : 2026-05-12 21:16

Updated : 2026-10-26 17:10

NVD link : CVE-2026-44010

Mitre link : CVE-2026-44010

CVE.ORG link : CVE-2026-44010

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44010", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44010", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:22:09.095422Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.9.18"}, {"status": "affected", "version": ">= 4.0.0, < 4.17.12"}]}]}], "published": "2026-05-12T21:16:15.720", "references": [{"url": "https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128", "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/cms/security/advisories/GHSA-gj2p-p9m4-c8gw", "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/cms/security/advisories/GHSA-gj2p-p9m4-c8gw", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18."}, {"lang": "es", "value": "Craft CMS es un sistema de gesti\u00f3n de contenido (CMS). Desde 4.0.0 hasta antes de 4.17.12 y 5.9.18, el resolvedor de elementos GraphQL Address (src/gql/resolvers/elements/Address.php) no realiza filtrado de alcance de esquema en consultas de nivel superior. Un token de API GraphQL con alcance a un \u00fanico grupo de usuarios de bajo privilegio puede leer cada direcci\u00f3n en el sistema, incluyendo direcciones pertenecientes a usuarios en grupos a los que el token no tiene autorizaci\u00f3n para acceder. Esto expone PII, incluyendo nombres completos, direcciones, organizaciones, n\u00fameros de identificaci\u00f3n fiscal, etc. Esta vulnerabilidad est\u00e1 corregida en 4.17.12 y 5.9.18."}], "lastModified": "2026-10-26T17:10:03.270", "sourceIdentifier": "security-advisories@github.com"}