8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28696

CVE-2026-28696: Craft affected by IDOR via GraphQL @parseRefs

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28696

CVE-2026-28696:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.0-beta.1	4.17.0-beta.1
craftcms/cms	composer	>= 5.0.0-RC1, < 5.9.0-beta.1	5.9.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) within the craft\services\Elements::parseRefs function, which is exposed through the @parseRefs GraphQL directive. The core issue, as detailed in the vulnerability description, is that parseRefs and its helper method _getRefTokenReplacement resolve element reference tags without validating if the current user has the necessary permissions to view the requested element or its attributes. This allows an attacker to bypass authorization and access sensitive data, such as user emails or content from private entries.

The provided patch does not modify the vulnerable Elements::parseRefs function itself. Instead, it mitigates the vulnerability by altering the craft\services\Gql::_loadGqlDirectives function to make the @parseRefs directive optional and disabled by default for GraphQL schemas. Previously, the ParseRefs directive was loaded unconditionally, making the vulnerability accessible in any GraphQL endpoint. The patch introduces a scope check, requiring administrators to explicitly enable the directive for a schema. While this contains the vulnerability, the underlying flaw in Elements::parseRefs remains. During exploitation on a vulnerable version, a runtime profiler would show calls to craft\services\Elements::parseRefs and craft\services\Elements::_getRefTokenReplacement when a malicious GraphQL query with the @parseRefs directive is processed.

Vulnerable functions

craft\services\Elements::parseRefs

src/services/Elements.php

The vulnerability description explicitly identifies `craft\services\Elements::parseRefs` as the function containing the Insecure Direct Object Reference (IDOR) vulnerability. It fails to perform authorization checks when parsing and resolving reference tags (e.g., `{user:1:email}`). The provided patch indirectly confirms this by making the `@parseRefs` GraphQL directive, which is the entry point to this vulnerable function, an optional feature. The removal of `ParseRefs::class` from the default list of directives in `_loadGqlDirectives` indicates that its functionality is considered dangerous and was previously exposed by default.

craft\services\Elements::_getRefTokenReplacement

src/services/Elements.php

According to the vulnerability description, this private helper method is used by `parseRefs` to fetch the referenced element and access the specified attribute. This is the point where the unauthorized data access occurs. As a key component in the vulnerable execution flow, it would likely appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.