PT-2026-22948 · Craft · Craft
Z3Rco
·
Published
2026-03-03
·
Updated
2026-03-04
·
CVE-2026-28696
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Craft versions prior to 4.17.0-beta.1 and versions prior to 5.9.0-beta.1
Description
Craft is a content management system (CMS) that contains a flaw in the GraphQL directive
@parseRefs. This directive, designed to parse internal reference tags, can be exploited by both authenticated users and unauthenticated guests (when a Public Schema is enabled) to access sensitive attributes of any element within the CMS. The Elements::parseRefs implementation lacks authorization checks, allowing attackers to read data they are not permitted to view. The vulnerability allows access to sensitive attributes through reference tags like {user:1:email}. Attack vectors include privilege escalation, user data leakage, arbitrary property reflection, server-side logic execution, and IDOR on private entries and assets. The @parseRefs directive is active in the Public Schema, enabling unauthenticated exploitation. Exploitation can occur through API endpoints, such as the GraphQL API endpoint /index.php?action=graphql/api, using payloads in queries. The vulnerable function is Elements::parseRefs. The vulnerability can lead to critical information disclosure, system information leakage, and potential authentication bypass.Recommendations
Versions prior to 4.17.0-beta.1: Modify
Elements::parseRefs to enforce canView permissions on the resolved element before extracting attributes.
Versions prior to 5.9.0-beta.1: Modify Elements::parseRefs to enforce canView permissions on the resolved element before extracting attributes.Exploit
Fix
IDOR
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Craft