{"schema":"threatline.record/2","record":{"id":"GHSA-7rr3-4jcm-x526","aliases":["GHSA-7rr3-4jcm-x526"],"summary":"GraphQL site-scope enforcement missing on entry create, \"deleteEntry\" without \"siteId\", and Category/Tag/Asset delete mutations","details":"Craft enforces GraphQL token site scope via `MutationResolver::requireAllowedSite()` (`src/gql/base/MutationResolver.php`), but at 5.10.13.2 it is invoked on only two code paths in the Entry mutation resolver and nowhere else. A GraphQL token scoped to site A can therefore mutate content belonging to site B:\r\n\r\n1. **Entry create** — the create branch of the save mutation never calls `requireAllowedSite()`. In `src/gql/resolvers/mutations/Entry.php`, the site check sits inside the `$canIdentify` (update) branch at `:282-284` (`if (isset($arguments['siteId'])) { $this->requireAllowedSite(...); }`); the create branch at `:303-305` (`$entry = $elementService->createElement(EntryElement::class);`) is reached with an attacker-supplied `siteId` and no scope check. A site-A token creates entries directly in site B.\r\n\r\n## Impact\r\n\r\nCross-site content-integrity compromise via a least-privilege API token: a token issued to manage only site A's content can inject entries into site B and delete entries, categories, tags, and assets in site B (and across all sites for shared elements). Bounding note, verified dynamically: elements existing only in site B are not reachable, because element fetch is confined to the token’s allowed sites — impact is limited to creations into site B and deletes of elements that also exist in an allowed site.\r\n\r\nReport ID: 1682","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-7rr3-4jcm-x526","source_modified_at":"2026-10-05T17:29:25Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-7rr3-4jcm-x526","source_modified_at":"2026-10-05T17:29:25Z","fetched_at":"2026-10-26T23:45:56.352924Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:29:25Z","modified_at":"2026-10-05T17:29:25Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-7rr3-4jcm-x526","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-05T17:29:25Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:29:25Z","content_hash":"51874e2cd85b8d986386ec623f12b26ad8a28737516f7986013b0962cdce46a5"}}