Craft CMS has IDOR via GraphQL @parseRefs
Date: 2026-03
Affected: composer/craftcms/cms, composer/craftcms/cms
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-28696
CWE: CWE-639
CWE-862

The GraphQL directive `@parseRefs`, intended to parse internal reference tags (e.g., `{user:1:email}`), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in `Elements::parseRefs` fails to perform authorization checks, allowing attackers to read data they are not authorized to view. ## Vulnerability Details `craft\services\Elements::parseRefs` identifies reference tags and resolves them using `_getRefTokenReplacement`. This method fetches the referenced element and accesses the specified attribute via $element->$attribute. - Missing Auth Check: It bypasses `canView()` checks. - Polymorphic Access: `getElementTypeByRefHandle` allows referencing any element type (entry, asset, user, category). - Custom Field Access: Since Craft elements use `__get()` to resolve custom field handles, an attacker is not limited to core attributes. They can exfiltrate any custom field data by enumerating the field handle (e.g. `{entry:123:privateNotes}`). ## Attack Vectors 1. Privilege Escalation / User Data Leak An attacker can enumerate sensitive attributes of administrators or other users. - Payload: `{user:1:email}` or `{user:1:photoId}` 2. Arbitrary Property Reflection & Server-Side Logic Execution The vulnerability allows reflecting any accessible property of the underlying Element model. - Username/Admin Enumeration: `{user:1:username}` (Confirmed: returns


Mitigations:

Architectural layers (MAESTRO):