Thirteen Craft CMS CVEs appeared on September 2, 2026 from two CVE Numbering Authorities, neither of them Craft — one advisory drew two separate CVE IDs, and a third record’s description belongs to a different bug entirely.
What happened
Craft CMS publishes its own security advisories on GitHub. It does not request CVE identifiers for them. Every one of the advisories discussed below carries the same line in its CVE field: “No known CVE.”
On September 2, 2026, thirteen Craft CMS CVEs were published anyway, by two CNAs that are not the vendor.
VulnCheck published eleven of them — CVE-2026-84792 through CVE-2026-84802 — at 12:17 p.m. UTC. They map onto a set of Craft advisories published August 18, 2026 and fixed in Craft CMS 5.10.11, and they run from a 4.3 broken-access-control issue in the element index up to a 9.8 privilege escalation.
Three hours later, at 3:17 p.m. UTC, a second CNA called Hackrate published two more: CVE-2026-79990 and CVE-2026-79991. Both cite Craft advisories, both cite a Hackrate “hacktivity” page, and CVE-2026-79991 credits a reporter, @Uncle_cui233, with Hackrate as coordinator. That ID was reserved on August 25, 2026.
One advisory, two CVE IDs
Craft’s advisory GHSA-3wcr-p33w-528f, “GQL entry mutation siteId bypasses schema site scope, enabling cross-site content read/write/delete,” is rated High by the vendor and fixed in 5.10.11. It now has two CVE identifiers.
VulnCheck’s CVE-2026-84796 references it and scores it CVSS 3.1 base 8.8 and CVSS 4.0 base 8.7, CWE-639. Hackrate’s CVE-2026-79990 references the same advisory and the same 5.10.11 release, scores it CVSS 4.0 base 8.7 with no CVSS 3.1 metric at all, and also assigns CWE-639. Same bug, same advisory, same fix, two identifiers, three hours apart.
One record describing a different bug
The second Hackrate record is the more serious problem. CVE-2026-79991 references Craft’s advisory GHSA-4mgp-5vf2-7c9m and the 5.10.13 release, carries CWE-89 — SQL injection — and scores CVSS 4.0 base 7.1 with an SSVC Technical Impact of partial.
Its description is this:
“Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from $arguments without passing through ArgumentManager prepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolver prepareElementQuery) correctly calls prepareArguments(), so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.”
That is the description on CVE-2026-79990, word for word. It is the GraphQL site-scope bypass, fixed in 5.10.11, classified CWE-639.
The advisory CVE-2026-79991 actually points at is titled “Authenticated SQL Injection via nested eager-loading criteria,” rated High, published September 1, 2026, and fixed in 5.10.13. Its description reads: “A non-admin, low-privileged Control Panel user (whose permission set is limited to the single baseline permission accessCp) can perform blind SQL injection against the element-index endpoint (element-indexes/get-elements and siblings), gaining arbitrary read access to the database.”
So the record’s CWE, its reference, its fixed version, and its score all describe a blind SQL injection reachable by a low-privileged Control Panel user. Its description describes an unrelated GraphQL authorization bypass reachable with a scoped API token. The CWE is the giveaway: CWE-89 sits on top of a paragraph that never mentions SQL.
The vendor said Moderate
The largest number in the batch is CVE-2026-84795, VulnCheck’s identifier for Craft’s advisory GHSA-242m-9wq7-vhwq, “Public registration inherits admin flag from deactivated admin accounts via missing guard.” Craft, which wrote the patch, labels that advisory Moderate.
VulnCheck scores it CVSS 3.1 base 9.8 on AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CVSS 4.0 base 9.2. NVD carries the 9.8 with a type of “Primary” — the ecosystem’s headline number for this issue is the third party’s, not the vendor’s.
The underlying condition, per Craft’s own text, is narrow: an attacker registers using the email address of an admin account that was deactivated rather than deleted, and the admin flag persists onto the new account. It requires public registration to be enabled and email verification to be disabled.
NVD’s handling of the batch is not consistent either. CVE-2026-84795 sits at vulnStatus “Received.” CVE-2026-84796, published in the same minute by the same CNA, is already “Deferred,” as are both Hackrate records.
Why it matters
This site reported on September 1 that Kyverno drew six CVEs in 38 seconds from a third-party CNA, one of them scored 3.7 and 9.3 for the same issue. This is the second instance in three days, and the failure is a different one: not a scoring conflict inside a record but duplicate identifiers across two CNAs, and a description transplanted from one bug onto another.
Third-party backfill exists for a real reason. A project that publishes GitHub advisories and never requests CVE IDs is invisible to every tool that keys on CVE identifiers — most vulnerability scanners, most SBOM pipelines, most procurement questionnaires. Someone filling that gap is doing work the ecosystem needs. Craft’s advisories are unusually good: they name the method, the endpoint, and the guard that was missing. They are exactly the kind of source a backfiller can work from.
The cost appears when that work is done at volume without the vendor in the loop. Every defect above is one the maintainer would have caught in a minute. Craft knows GHSA-3wcr-p33w-528f is one bug, not two. Craft knows what GHSA-4mgp-5vf2-7c9m says, having written it the day before. And Craft’s own advisories still read “No known CVE” for issues that now carry identifiers, because nothing tells a maintainer that a stranger assigned CVEs to their advisories.
Duplication is not a cosmetic problem. Deduplication is a core CNA function — the whole value of a CVE identifier is that it is one name for one flaw, so that two tools reporting the same issue can be recognized as reporting the same issue. An organization counting Craft CMS vulnerabilities for a risk register now counts the GraphQL site-scope bypass twice. A tool that maps 84796 and 79990 to different remediation tickets will chase a fix that was already applied.
The wrong description is worse, because it is actively misleading in the direction of doing nothing. A defender who reads CVE-2026-79991 as written will conclude the issue is a GraphQL API token problem and check whether GraphQL is even enabled. The advisory it points at describes an attack available to any authenticated Control Panel user holding a single baseline permission. Those are different threat models, different mitigations, and different sets of people to worry about. The record contains both, and only one of them is right.
The severity gap is the least alarming of the three, and worth stating carefully. Vendors and third parties disagree about scores all the time, and a CVSS base score is not supposed to model deployment conditions. Craft’s Moderate reflects a bug that needs public registration on, verification off, and a deactivated-not-deleted admin whose email the attacker knows. VulnCheck’s 9.8 reflects what happens when those conditions hold. Neither is dishonest. What matters is which one the ecosystem inherits, and NVD’s “Primary” flag answers that: the 9.8. The vendor’s judgment is one page away, on an advisory that says no CVE exists.
What to do
Upgrade Craft CMS 5 to 5.10.13 or later. That covers both batches: 5.10.11 fixed the August 18 advisories behind CVE-2026-84792 through CVE-2026-84802, and 5.10.13’s release notes list seven further advisories including GHSA-4mgp-5vf2-7c9m and three high-severity remote code execution issues (GHSA-5jmw-g85v-7jv2, GHSA-9c4j-cjw3-r3xx, GHSA-5r92-75j8-c534).
If public registration is enabled on a Craft site, check whether email verification is required, and audit for deactivated admin accounts. Deleting a departed administrator’s account, or changing its email address, removes the precondition for CVE-2026-84795 independently of the patch.
When scoping any of these, read Craft’s GitHub advisories rather than the CVE records. The advisories name the endpoint and the missing check; several of the CVE records do not, and one of them names the wrong bug. Treat CVE-2026-84796 and CVE-2026-79990 as a single issue. Ignore CVE-2026-79991’s description and follow its reference instead.
Sourcing note
Checked: NVD records for CVE-2026-84792 through CVE-2026-84802, CVE-2026-79990, and CVE-2026-79991, giving publication timestamps, source identifiers, metrics with source and type, CWEs, references, and vulnStatus values. Checked: the CVE Program record for CVE-2026-79991, giving Hackrate as assigner with organization ID 7004884b-51e2-48e8-b4a2-5ca29e80453e, a reserved date of August 25, 2026, the credited reporter, and the affected range of 5.0.0-RC1 through 5.10.12. Checked: Craft’s advisories GHSA-242m-9wq7-vhwq, GHSA-3wcr-p33w-528f, and GHSA-4mgp-5vf2-7c9m for their titles, vendor severity labels, CVE fields, and descriptions, all quoted above. Checked: VulnCheck’s advisory page for CVE-2026-84795.
Not resolved: whether the duplicate assignment on GHSA-3wcr-p33w-528f will be rejected on one side, and which one. Not resolved: whether CVE-2026-79991’s description will be corrected, or whether Craft has been notified of any of this — neither CNA’s record shows vendor coordination, and Craft’s advisories still read “No known CVE.” The publication date shown on the 5.10.13 release page did not parse reliably on this fetch, so the release date is not stated here; the advisory it fixes is dated September 1, 2026. No exploitation of any CVE in this batch has been reported, and none is in the KEV catalog as of this writing.