CVE-2026-44010
published 2026-05-12CVE-2026-44010: Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver…
PriorityP342high7.1CVSS 4.0
AVNACLATNPRLUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.34%
25.7th percentile
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. This vulnerability is fixed in 4.17.12 and 5.9.18.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| craftcms | cms | — | — |
| craftcms | cms | — | — |
| craftcms | cms | >= 4.0.0 < 4.17.12 | 4.17.12 |
| craftcms | cms | >= 5.0.0 < 5.9.18 | 5.9.18 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Craft CMS up to 4.17.11/5.9.17 Address.php authorization
vuldb·2026-05-12
CVE-2026-44010 [LOW] Craft CMS up to 4.17.11/5.9.17 Address.php authorization
A vulnerability was found in Craft CMS up to 4.17.11/5.9.17. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file src/gql/resolvers/elements/Address.php. Performing a manipulation results in missing authorization.
This vulnerability was named CVE-2026-44010. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is advised.
GHSA
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
ghsa·2026-05-06
CVE-2026-44010 [HIGH] CWE-862 Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
### Summary
The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc.
### Details
Every GraphQL element resolver in Craft CMS applies schema scope filtering via `GqlHelper::extractAllowedEntitiesFromSchema()` when handling top-level queries, except the Address resolver.
The only gate check for addresses is `canQueryUsers()` (`src/gql/queries/Addre
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published