Craft CMS Authorization Bypass Lets Site-Scoped GraphQL Tokens Mutate Other Sites

Craft CMS versions 5.0.0 through 5.10.x contain an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced.

Attackers holding a site-A token can create entries in site B via a supplied siteId and delete entries, categories, tags, and assets shared across sites.

• Affected versions: 5.0.0 before 5.11.0
• Precondition: attacker has a site-scoped GraphQL token for one site
• Impact: cross-site content creation and deletion