Vulnerability · Published Mar 4, 2026 · Assigned by GitHub_M
CVE-2026-28696Craft affected by IDOR via GraphQL @parseRefs
High 8.7
In plain English
A high-severity authorization bypass via user-controlled key in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/cms | 4.17.0-beta.1 | GHSA-7x43-mpfg-r9wj |
| Packagist | craftcms/cms | 5.9.0-beta.1 | GHSA-7x43-mpfg-r9wj |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N