Количество 3
Количество 3
CVE-2026-44010
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.
GHSA-gj2p-p9m4-c8gw
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
BDU:2026-07030
Уязвимость системы управления контентом Craft CMS, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-44010 Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18. | 0% Низкий | 3 месяца назад | |
| GHSA-gj2p-p9m4-c8gw Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | 0% Низкий | 3 месяца назад | |
 | BDU:2026-07030 Уязвимость системы управления контентом Craft CMS, связанная с отсутствием авторизации, позволяющая нарушителю раскрыть защищаемую информацию | CVSS3: 6.5 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу