craft cms
Craft's GraphQL 'Sites scope' had two separate holes in it — and both needed zero credentials
Two moderate-severity advisories, patched together in Craft 5.11.2, show how a schema's Sites scope could be read around entirely: once through an element field missing its site argument, once by chaining prev/next across entries. Neither needed a login, a token, or any non-default configuration.
