Craft CMS contains a GraphQL directive named @parseRefs that resolves internal reference tags such as {user:1:email}. The element parser that processes this directive does not perform the required authorization checks, creating an Insecure Direct Object Reference flaw. As a result, attackers can read sensitive attributes of any element in the CMS, including data that the attacker should not be able to view. The vulnerability can be exploited by sending crafted GraphQL queries, and it is usable by both authenticated users and unauthenticated visitors when a Public Schema is enabled.

The affected products are CraftCMS CMS releases prior to 4.17.0‑beta.1 in the 4.x line and prior to 5.9.0‑beta.1 in the 5.x line. Any functional release of those versions that exposes the @parseRefs directive is vulnerable.

The flaw carries a CVSS base score of 8.7, indicating high severity. The EPSS score is reported as less than 1%, implying a very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can target the flaw remotely over GraphQL, and because no privilege escalation is required beyond the existing user or guest permissions, the risk is largely confined to unauthorized data disclosure rather than system compromise.