CVE-2026-28696 Craft affected by IDOR via GraphQL @parseRefs

What is CVE-2026-28696?

CVE-2026-28696 is a high-severity missing authorization vulnerability in Craftcms Craft Cms, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

Weakness: CWE-639

Which versions are affected by CVE-2026-28696?

4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.

Products include Craftcms Craft Cms.

How do I fix CVE-2026-28696?

Upgrade craftcms/cms to a fixed version for your release line: 4.17.0-beta.1 or 5.9.0-beta.1.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28696 being exploited?

There is no known exploitation of CVE-2026-28696 in the wild and no public exploit code.

Other vulnerabilities in Craftcms Craft Cms

• CVE-2025-32432 Craft CMS Code Injection Exploited Critical 10.0
• CVE-2024-56145 Craft CMS Code Injection Exploited Critical 9.3
• CVE-2025-23209 Craft CMS Code Injection Exploited High 8.1
• CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter Exploited Medium 6.9
• CVE-2023-41892 Craft CMS Remote Code Execution vulnerability Critical 10.0

All Craftcms Craft Cms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7x43-mpfg-r9wj.