A flaw in Craft CMS’s GraphQL mutation resolvers allows an authenticated user with a token scoped to one site to set the siteId field in mutation arguments. The resolver bypasses the normal site‑scoping checks used for queries, giving the attacker the ability to create, update or delete entries on sites other than the one authorized for the token. This leads to unintended alteration of database contents, potentially exposing, corrupting, or removing data for any site the attacker can target.

Craft CMS before version 5.10.13 is affected. The advisory indicates that the issue was resolved in the 5.10.13 release, so any deployment running an earlier 5.10 series version remains vulnerable.

The CVSS score of 7.1 shows a high likelihood of significant impact. The vulnerability requires an authenticated token and does not rely on network exploits, but it can be leveraged by any user who has legitimate access within the CMS. Because the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, the current external exploitation probability appears low; however, the presence of a SQL‑injection vector and the capacity to manipulate data across sites elevates the risk for compromised accounts. Prompt patching is recommended to eliminate the risk.