Craft CMS from version 5.0.0 up to but not including 5.11.0 contains an authorization bypass that permits an attacker with a site‑specific GraphQL token to perform mutations on any other site by supplying a target siteId. The bug stems from a missing check that requires a token to belong to the targeted site. Consequently, an attacker can create, modify, delete, or otherwise manipulate entries, categories, tags, and shared assets belonging to other sites, undermining the integrity of content across the installation. This flaw does not enable arbitrary code execution, but it allows full disruptive control over the content management subsystem and can be leveraged to tamper with site assets, potentially leading to data loss or compromise of brand reputation.

All installations of Craft CMS version 5.0.0 through 5.10.9 are affected. The vulnerability targets the Craft CMS web‑content management system provided by the craftcms:cms vendor product. No patch or workaround is currently released for earlier versions; upgrading to 5.11.0 or later is required to remove the flaw.

The CVSS base score of 9.3 indicates critical severity, and while EPSS data is not available, the nature of the flaw suggests that exploitability is realistic for an attacker who can acquire a site‑scoped token—through credential compromise or misconfigurations. The vulnerability is not yet listed in CISA’s KEV catalog, but the high severity and the absence of mitigation make any affected deployment a top priority for patching. An attacker could execute the bypass with minimal input, using the GraphQL mutation endpoint, which implies a low technical barrier for exploitation on exposed systems.