Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Craft CMS

  • Four deadlines expire Saturday, which is why the day’s four fresh 9.8s are not the lead

    Four deadlines expire Saturday, which is why the day’s four fresh 9.8s are not the lead

    Four items published today carry a federal remediation deadline of Saturday, September 5. That is two days out, and it is the day’s lead. It outranks the four fresh 9.8s that landed alongside it, because a 9.8 with no confirmed exploitation and no clock attached is a patch you schedule, and a Saturday deadline is a patch somebody has to be at a keyboard for. Two of those 9.8s do not have a release number to install anyway.

    The thread is real, and it is CISA’s. Six of today’s ten stories trace back to one batch of Known Exploited Vulnerabilities additions made on September 2 — four due September 5, two due September 16. Running underneath it is the same problem in three of the four Saturday items: the authoritative record does not cleanly say what to install.

    Deal with SonicWall’s SMA1000 pair first. It is an internet-facing access appliance, it is the third zero-day pair on that product, and the CVE records SonicWall assigned itself list affected builds without naming a fixed one — two days before the deadline. Then JFrog Artifactory, where CISA’s listing is the first government confirmation that the unauthenticated administrative bypass is being exploited, and where the medium-severity Artifactory CVE listed six days earlier is now due five days later than the critical one. Then Sangoma’s Switchvox, where the release notes mark the fix for both cloud and on-premises but the only CPE on the record covers on-premises, so an agency running the cloud edition cannot tell from the record whether it is in scope. Then Kestra, the one of the four whose difficulty is a label rather than a version: CISA files it as OS command injection, and what an attacker actually reaches is a filter asking whether a request path ends with the word configs.

    The two September 16 items are lower on the clock and higher on reach. Starlette’s BadHost is a 6.5 by three independent scorers, which is the number most likely to send a KEV entry to the bottom of a patch queue — and Starlette is what FastAPI is built on, so the inventory question is not “do we run Starlette” but “what did we build on FastAPI.” LiteLLM is the narrower one, and the sharper bug: the MCP endpoint answered a failed key check by substituting an empty authorization object and letting the request through.

    After the clocked items, the 9.8s. Cisco’s Nexus 9000 Silicon One root RCE names ten switch SKUs and points its Fixed Software section at an interactive tool instead of a release number; the record has no CPE data at all. Cisco’s IOS XR hardening release, published the same afternoon, packages an internal audit into seven CVEs across every release, two of them 9.8, with one CVE ID standing for thirteen distinct weakness types. That is Cisco twice in one day, both times with a remediation story that is harder to read than the vulnerability. Delinea’s Secret Server takes a 9.8 at the FIDO2 registration step in a privileged access manager, and NVD deferred the record the following day, leaving it with no machine-matchable version data. And thirteen Craft CMS CVEs arrived from two CNAs, neither of them Craft, onto advisories that say “No known CVE” — with one advisory drawing two IDs and one record carrying a description for a different bug.

    What is still open. SonicWall has not named a fixed build for either SMA1000 CVE with the deadline on Saturday. JFrog has published no in-the-wild statement of its own; the government confirmed exploitation before the vendor did. Sangoma has not resolved the cloud-versus-on-premises scope on the record itself. Cisco’s first IOS XR fix that is not a software maintenance update has not shipped, and it revised the fixed-release list within six hours of publishing it. The Delinea record is deferred, so scanners matching on CPE will not flag an affected install.

  • Two CNAs backfilled thirteen CVEs onto Craft CMS advisories that say “No known CVE,” and one record’s description belongs to a different bug

    Two CNAs backfilled thirteen CVEs onto Craft CMS advisories that say “No known CVE,” and one record’s description belongs to a different bug

    Thirteen Craft CMS CVEs appeared on September 2, 2026 from two CVE Numbering Authorities, neither of them Craft — one advisory drew two separate CVE IDs, and a third record’s description belongs to a different bug entirely.

    What happened

    Craft CMS publishes its own security advisories on GitHub. It does not request CVE identifiers for them. Every one of the advisories discussed below carries the same line in its CVE field: “No known CVE.”

    On September 2, 2026, thirteen Craft CMS CVEs were published anyway, by two CNAs that are not the vendor.

    VulnCheck published eleven of them — CVE-2026-84792 through CVE-2026-84802 — at 12:17 p.m. UTC. They map onto a set of Craft advisories published August 18, 2026 and fixed in Craft CMS 5.10.11, and they run from a 4.3 broken-access-control issue in the element index up to a 9.8 privilege escalation.

    Three hours later, at 3:17 p.m. UTC, a second CNA called Hackrate published two more: CVE-2026-79990 and CVE-2026-79991. Both cite Craft advisories, both cite a Hackrate “hacktivity” page, and CVE-2026-79991 credits a reporter, @Uncle_cui233, with Hackrate as coordinator. That ID was reserved on August 25, 2026.

    One advisory, two CVE IDs

    Craft’s advisory GHSA-3wcr-p33w-528f, “GQL entry mutation siteId bypasses schema site scope, enabling cross-site content read/write/delete,” is rated High by the vendor and fixed in 5.10.11. It now has two CVE identifiers.

    VulnCheck’s CVE-2026-84796 references it and scores it CVSS 3.1 base 8.8 and CVSS 4.0 base 8.7, CWE-639. Hackrate’s CVE-2026-79990 references the same advisory and the same 5.10.11 release, scores it CVSS 4.0 base 8.7 with no CVSS 3.1 metric at all, and also assigns CWE-639. Same bug, same advisory, same fix, two identifiers, three hours apart.

    One record describing a different bug

    The second Hackrate record is the more serious problem. CVE-2026-79991 references Craft’s advisory GHSA-4mgp-5vf2-7c9m and the 5.10.13 release, carries CWE-89 — SQL injection — and scores CVSS 4.0 base 7.1 with an SSVC Technical Impact of partial.

    Its description is this:

    “Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from $arguments without passing through ArgumentManager prepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolver prepareElementQuery) correctly calls prepareArguments(), so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.”

    That is the description on CVE-2026-79990, word for word. It is the GraphQL site-scope bypass, fixed in 5.10.11, classified CWE-639.

    The advisory CVE-2026-79991 actually points at is titled “Authenticated SQL Injection via nested eager-loading criteria,” rated High, published September 1, 2026, and fixed in 5.10.13. Its description reads: “A non-admin, low-privileged Control Panel user (whose permission set is limited to the single baseline permission accessCp) can perform blind SQL injection against the element-index endpoint (element-indexes/get-elements and siblings), gaining arbitrary read access to the database.”

    So the record’s CWE, its reference, its fixed version, and its score all describe a blind SQL injection reachable by a low-privileged Control Panel user. Its description describes an unrelated GraphQL authorization bypass reachable with a scoped API token. The CWE is the giveaway: CWE-89 sits on top of a paragraph that never mentions SQL.

    The vendor said Moderate

    The largest number in the batch is CVE-2026-84795, VulnCheck’s identifier for Craft’s advisory GHSA-242m-9wq7-vhwq, “Public registration inherits admin flag from deactivated admin accounts via missing guard.” Craft, which wrote the patch, labels that advisory Moderate.

    VulnCheck scores it CVSS 3.1 base 9.8 on AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CVSS 4.0 base 9.2. NVD carries the 9.8 with a type of “Primary” — the ecosystem’s headline number for this issue is the third party’s, not the vendor’s.

    The underlying condition, per Craft’s own text, is narrow: an attacker registers using the email address of an admin account that was deactivated rather than deleted, and the admin flag persists onto the new account. It requires public registration to be enabled and email verification to be disabled.

    NVD’s handling of the batch is not consistent either. CVE-2026-84795 sits at vulnStatus “Received.” CVE-2026-84796, published in the same minute by the same CNA, is already “Deferred,” as are both Hackrate records.

    Why it matters

    This site reported on September 1 that Kyverno drew six CVEs in 38 seconds from a third-party CNA, one of them scored 3.7 and 9.3 for the same issue. This is the second instance in three days, and the failure is a different one: not a scoring conflict inside a record but duplicate identifiers across two CNAs, and a description transplanted from one bug onto another.

    Third-party backfill exists for a real reason. A project that publishes GitHub advisories and never requests CVE IDs is invisible to every tool that keys on CVE identifiers — most vulnerability scanners, most SBOM pipelines, most procurement questionnaires. Someone filling that gap is doing work the ecosystem needs. Craft’s advisories are unusually good: they name the method, the endpoint, and the guard that was missing. They are exactly the kind of source a backfiller can work from.

    The cost appears when that work is done at volume without the vendor in the loop. Every defect above is one the maintainer would have caught in a minute. Craft knows GHSA-3wcr-p33w-528f is one bug, not two. Craft knows what GHSA-4mgp-5vf2-7c9m says, having written it the day before. And Craft’s own advisories still read “No known CVE” for issues that now carry identifiers, because nothing tells a maintainer that a stranger assigned CVEs to their advisories.

    Duplication is not a cosmetic problem. Deduplication is a core CNA function — the whole value of a CVE identifier is that it is one name for one flaw, so that two tools reporting the same issue can be recognized as reporting the same issue. An organization counting Craft CMS vulnerabilities for a risk register now counts the GraphQL site-scope bypass twice. A tool that maps 84796 and 79990 to different remediation tickets will chase a fix that was already applied.

    The wrong description is worse, because it is actively misleading in the direction of doing nothing. A defender who reads CVE-2026-79991 as written will conclude the issue is a GraphQL API token problem and check whether GraphQL is even enabled. The advisory it points at describes an attack available to any authenticated Control Panel user holding a single baseline permission. Those are different threat models, different mitigations, and different sets of people to worry about. The record contains both, and only one of them is right.

    The severity gap is the least alarming of the three, and worth stating carefully. Vendors and third parties disagree about scores all the time, and a CVSS base score is not supposed to model deployment conditions. Craft’s Moderate reflects a bug that needs public registration on, verification off, and a deactivated-not-deleted admin whose email the attacker knows. VulnCheck’s 9.8 reflects what happens when those conditions hold. Neither is dishonest. What matters is which one the ecosystem inherits, and NVD’s “Primary” flag answers that: the 9.8. The vendor’s judgment is one page away, on an advisory that says no CVE exists.

    What to do

    Upgrade Craft CMS 5 to 5.10.13 or later. That covers both batches: 5.10.11 fixed the August 18 advisories behind CVE-2026-84792 through CVE-2026-84802, and 5.10.13’s release notes list seven further advisories including GHSA-4mgp-5vf2-7c9m and three high-severity remote code execution issues (GHSA-5jmw-g85v-7jv2, GHSA-9c4j-cjw3-r3xx, GHSA-5r92-75j8-c534).

    If public registration is enabled on a Craft site, check whether email verification is required, and audit for deactivated admin accounts. Deleting a departed administrator’s account, or changing its email address, removes the precondition for CVE-2026-84795 independently of the patch.

    When scoping any of these, read Craft’s GitHub advisories rather than the CVE records. The advisories name the endpoint and the missing check; several of the CVE records do not, and one of them names the wrong bug. Treat CVE-2026-84796 and CVE-2026-79990 as a single issue. Ignore CVE-2026-79991’s description and follow its reference instead.

    Sourcing note

    Checked: NVD records for CVE-2026-84792 through CVE-2026-84802, CVE-2026-79990, and CVE-2026-79991, giving publication timestamps, source identifiers, metrics with source and type, CWEs, references, and vulnStatus values. Checked: the CVE Program record for CVE-2026-79991, giving Hackrate as assigner with organization ID 7004884b-51e2-48e8-b4a2-5ca29e80453e, a reserved date of August 25, 2026, the credited reporter, and the affected range of 5.0.0-RC1 through 5.10.12. Checked: Craft’s advisories GHSA-242m-9wq7-vhwq, GHSA-3wcr-p33w-528f, and GHSA-4mgp-5vf2-7c9m for their titles, vendor severity labels, CVE fields, and descriptions, all quoted above. Checked: VulnCheck’s advisory page for CVE-2026-84795.

    Not resolved: whether the duplicate assignment on GHSA-3wcr-p33w-528f will be rejected on one side, and which one. Not resolved: whether CVE-2026-79991’s description will be corrected, or whether Craft has been notified of any of this — neither CNA’s record shows vendor coordination, and Craft’s advisories still read “No known CVE.” The publication date shown on the 5.10.13 release page did not parse reliably on this fetch, so the release date is not stated here; the advisory it fixes is dated September 1, 2026. No exploitation of any CVE in this batch has been reported, and none is in the KEV catalog as of this writing.