PT-2026-38285 · Craft Cms · Craft Cms

Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-44010

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.17.11 Craft CMS versions 5.0.0 through 5.9.17

Description The GraphQL Address element resolver in src/gql/resolvers/elements/Address.php fails to perform schema scope filtering on top-level queries. While other element resolvers use GqlHelper::extractAllowedEntitiesFromSchema() to enforce boundaries, the Address resolver only utilizes a binary check via the canQueryUsers() function. If a GraphQL API token has access to any single user group, it can bypass authorization to read every address in the system, including those belonging to users in restricted groups. This allows for the exposure of personally identifiable information (PII) such as full names, addresses, organizations, and tax IDs. Additionally, the ownerId variable in the addresses query can be used to extract specific users' addresses regardless of the token's scope.

Recommendations Update Craft CMS to version 4.17.12. Update Craft CMS to version 5.9.18.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07030

CVE-2026-44010

GHSA-GJ2P-P9M4-C8GW

Affected Products

Craft Cms

References · 8

• 🔥 https://github.com/craftcms/cms/security/advisories/GHSA-gj2p-p9m4-c8gw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44010 · Security Note
• https://osv.dev/vulnerability/GHSA-gj2p-p9m4-c8gw · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07030 · Security Note
• https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128 · Note
• https://github.com/craftcms/cms · Note
• https://twitter.com/CVEnew/status/2054324025762123811 · Twitter Post
• https://t.me/CSIRT_italia/3501 · Telegram Post