AIKIDO-2026-786302

TL;DR

The saveEntry and deleteEntry GraphQL mutation resolvers read siteId directly from the mutation arguments instead of going through the argument handling that restricts requests to the sites allowed by the schema. A GraphQL token scoped to one site can therefore create, modify, or delete entries on a different site the token was never granted access to. The fix routes mutation arguments through the same site-scope check used for queries.