CVE-2026-56381
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile — higher than 4% of all known CVEs
Summary
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.
Risk Assessment
This vulnerability could lead to the execution of malicious JavaScript code in the context of other users' browsers, posing risks of data theft or session hijacking. Organizations should be aware of the potential threats associated with unauthorized access to user permissions.
Recommendation
It is recommended to update Craft CMS to the latest version that addresses this vulnerability. Additionally, access to the user permissions page should be restricted to trusted administrators.
Original NVD description (English source)
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.