Craft CMS versions 4.0.0 through 4.17.11 and 5.9.0 through 5.9.17 contain a missing authorization check in the GraphQL Address element resolver. The resolver does not enforce schema scope filtering on top‑level queries, allowing an attacker holding a GraphQL API token scoped to a low‑privilege user group to retrieve every address record in the system. This exposes personally identifiable information such as full names, mailing addresses, organizations, and tax identifiers. The flaw is a classic authorization bypass, classifiable under CWE‑862, and directly impacts data confidentiality.

The vulnerability affects Craft CMS installations running any version from 4.0.0 up to, but not including, 4.17.12, and from 5.9.0 up to, but not including, 5.9.18. Users of these products should verify that they have not deployed the affected release versions.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker who obtains a GraphQL API token—whether through credential compromise or by creating a token with a limited user group scope—can leverage the API to perform cross‑scope data retrieval. No additional conditions such as elevated server privileges or network access are required beyond the possession of a valid token. The attack vector is thus the GraphQL API and the exploitation path is straightforward: send a top‑level address query using the compromised token and receive all address data.