CVE-2026-28696
Published: 04 March 2026
Summary
CVE-2026-28696 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Craftcms Craft Cms. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in public-facing Craft CMS GraphQL endpoint (no auth checks on @parseRefs/Elements::parseRefs) directly enables remote exploitation of a public application for initial access (T1190) and unauthorized collection of sensitive data from the CMS information repository (T1213).
NVD Description
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled)…
more
to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Deeper analysisAI
CVE-2026-28696 is an authorization bypass vulnerability in Craft, a content management system (CMS). In versions prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs—intended to parse internal reference tags such as {user:1:email}—suffers from inadequate implementation in the Elements::parseRefs method, which fails to enforce authorization checks. This flaw enables unauthorized access to sensitive attributes of any element within the CMS.
The vulnerability can be exploited remotely over the network with low complexity by both authenticated users and unauthenticated guests, provided a Public Schema is enabled. Successful exploitation allows attackers to read sensitive data they lack permission to view, resulting in high confidentiality impact with no integrity or availability disruption. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-639 (Authorization Bypass Through User-Controlled Key).
Craft CMS addresses this issue in versions 4.17.0-beta.1 and 5.9.0-beta.1. Additional details are available in the GitHub security advisory at https://github.com/craftcms/cms/security/advisories/GHSA-7x43-mpfg-r9wj and the fixing commit at https://github.com/craftcms/cms/commit/4d98a07e47580f1712095825d3e3c4d67bc9f8b9.
Details
- CWE(s)