CVE-2026-28696: 
PHP vulnerability analysis and mitigation

CVE-2026-28696 is an Insecure Direct Object Reference (IDOR) vulnerability in Craft CMS via the GraphQL @parseRefs directive, allowing unauthorized access to sensitive CMS element attributes. It affects Craft CMS versions >= 4.0.0-RC1 and < 4.17.0-beta.1, and >= 5.0.0-RC1 and < 5.9.0-beta.1. The vulnerability was published on March 2, 2026, by researcher z3rco via the GitHub Advisory Database. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is a missing authorization check (CWE-639: Authorization Bypass Through User-Controlled Key; CWE-862: Missing Authorization) in the craft\services\Elements::parseRefs method. When the @parseRefs GraphQL directive processes internal reference tags (e.g., {user:1:email}), it resolves element attributes via $element->$attribute without invoking canView() permission checks. Because getElementTypeByRefHandle supports polymorphic access across all element types (entries, assets, users, categories), an attacker can enumerate any element type and any attribute — including custom fields via Craft's __get() magic method. Unauthenticated exploitation is possible when the Public Schema is enabled, as the directive is active within that schema by default (GitHub Advisory, Craft CMS Advisory).

Successful exploitation results in a high-severity confidentiality breach with no integrity or availability impact. Attackers can exfiltrate PII such as user emails, usernames, and admin status (e.g., {user:1:email}, {user:1:username}), read private entry custom fields (e.g., {entry:456:privateNotes}), and expose internal server file paths via stack traces triggered by certain attribute accesses (e.g., {user:1:authKey}). Unauthenticated guests can exploit this against any Craft CMS instance with the Public Schema enabled, effectively bypassing all content access controls (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a working curl command demonstrating unauthenticated data extraction. There is no current evidence of active in-the-wild exploitation. The vulnerability requires no authentication when the Public Schema is enabled, and no user interaction is needed. The EPSS score is approximately 0.024% (0.000410), placing it in the 7th percentile for exploitation likelihood (GitHub Advisory, Feedly). The CVE is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify Craft CMS instances exposed to the internet. Check if the GraphQL Public Schema is enabled by sending a test GraphQL query to /index.php?action=graphql/api.
2. Identify a queryable element: Determine which element types and sections are accessible via the Public Schema (e.g., a "News" section with entries).
3. Inject a reference tag payload: If an admin has stored a reference tag as content (e.g., set an entry title to {user:1:email}), or craft a query that uses @parseRefs on a field containing such a tag.
4. Send the exploit request: Issue an unauthenticated POST request to the GraphQL API endpoint:

curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"query": "{ entries { title @parseRefs } }"}' \
  http://target/index.php?action=graphql/api

5. Extract sensitive data: The API returns resolved attribute values, e.g., {"data":{"entries":[{"title":"admin"}]}} for {user:1:username} or the admin's email address.
6. Enumerate further: Iterate over element IDs and attribute names (e.g., {user:2:email}, {entry:123:privateNotes}, {volume:1:path}) to exfiltrate additional PII, custom field data, or internal server paths via error stack traces (GitHub Advisory, Craft CMS Advisory).

• Network: Unusual or repeated POST requests to /index.php?action=graphql/api containing @parseRefs in the query body; requests from unauthenticated sources querying user or entry attributes via reference tag syntax (e.g., {user:1:email}, {entry:*:*}).
• Logs: Web server access logs showing high-frequency GraphQL API calls with @parseRefs directive usage; GraphQL error responses containing PHP stack traces with internal server paths (e.g., /var/www/html/...) indicating {user:1:authKey}-style probing.
• Application Logs: Craft CMS application logs recording repeated element resolution requests for sequential IDs across multiple element types (users, entries, assets) without corresponding authenticated sessions.

Upgrade to Craft CMS 4.17.0 or later for version 4.x installations, or to 5.9.0 or later for version 5.x installations. The fix makes the @parseRefs directive optional per GraphQL schema — it must now be explicitly enabled via a directive:parseRefs scope setting, and is no longer active by default in the Public Schema. As an immediate workaround if upgrading is not possible, disable the Public Schema in GraphQL settings to restrict access to authenticated users only (this limits but does not fully eliminate risk for authenticated attackers). Audit GraphQL schema permissions and review CMS access logs for suspicious @parseRefs usage (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher z3rco and published by Craft CMS maintainer angrybrad via the GitHub Security Advisory on March 2, 2026. The fix was committed promptly, making @parseRefs an opt-in directive per schema rather than globally active. No significant broader media coverage or notable community controversy has been identified beyond the advisory and standard CVE tracking (GitHub Advisory).