Vulnerability Description
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/craftcms/cms/security/advisories/GHSA-pcmv-c398-gc5m
- https://www.vulncheck.com/advisories/craft-cms-before-5.11.0-unauthenticated-pii
FAQ
What is CVE-2026-92594?
CVE-2026-92594 is a vulnerability with a CVSS score of 7.5 (HIGH). Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() ...
How severe is CVE-2026-92594?
CVE-2026-92594 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92594?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.