Craft CMS before version 5.11.0 does not enforce user-group scope filters on native GraphQL user relations such as author, authors, uploader, draftCreator, and revisionCreator. Attackers possessing any scoped GraphQL token can query these relations and obtain usernames, email addresses, and full names of all content authors or uploaders, including administrators. These fields normally respect group membership but the filter is bypassed, allowing unconditional data exposure.

Craft CMS, product by Craft CMS, is affected. Versions prior to 5.11.0 are vulnerable. The vulnerability was identified in the Craft CMS codebase hosted by Craft CMS.

The CVSS score is 5.3, indicating a moderate severity for confidentiality impact. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of a GraphQL token with any scope granted by the site administrator. If such a token exists, an attacker can simply issue a GraphQL query to the vulnerable fields and retrieve PII. No need for elevated privileges or remote code execution; however, the exposed data can be used for phishing or account takeover attacks.