CVE-2026-44010
HighSummary
Craft CMS has a vulnerability that allows low-privilege users to read address data. The issue stems from a lack of schema scope filtering in GraphQL queries, enabling access to personal data of users from other groups.
Risk Assessment
Organizations may be exposed to the disclosure of personal data, leading to privacy violations and potential legal consequences. The exposure of information such as full names, addresses, and tax IDs poses a serious risk.
Recommendation
It is recommended to update Craft CMS to versions 4.17.12 or 5.9.18 to mitigate this vulnerability. Additionally, conducting an access audit is advised to ensure no unauthorized access has occurred.
Other vulnerabilities in Craft CMS
See all- CVE-2026-72784Medium
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.
- CVE-2026-72781High
Craft CMS versions from 5.0.0-RC1 before 5.10.7 and from 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism, allowing an authenticated attacker with control panel access to execute arbitrary code.
- CVE-2026-72779Medium
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
- CVE-2026-31266High
Craft CMS version 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).
- CVE-2026-44012High
Craft CMS prior to version 5.9.18 has a vulnerability in AssetsController::actionShowInFolder() that allows fetching the filename and full folder hierarchy of an asset without checking user permissions. Any authenticated CP user, even without volume permissions, can enumerate asset filenames and folder structures.
- CVE-2026-44011High
Craft CMS contains an input-handling flaw that allows authenticated users to inject malicious configuration and execute arbitrary commands on the server. The issue affects versions from 4.0.0 to before 4.17.12 and 5.9.18.
- CVE-2025-68455High
Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via a maliciously attached Behavior. The attack requires administrator access to the Craft Control Panel.
- CVE-2025-68454High
Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via Twig SSTI. The vulnerability requires administrator access to the Control Panel with allowAdminChanges enabled, or a non-admin account with access to the System Messages utility. A malicious payload using the Twig `map` filter in Twig-accepting text fields can lead to RCE.
- CVE-2025-68456Critical
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
- CVE-2026-79988High
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
Original NVD description (English source)
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.