Every CVE Search/ Get API key

CVE-2026-56381

Craft CMS - Stored XSS via User Group Name in User Permissions Page

4.6 MediumFix available

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.18%Unchanged since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.6

Craft CMS - Stored XSS via User Group Name in User Permissions Page

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Record
CVE-2026-56381
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-38175 4.6

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Record
EUVD-2026-38175
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9r7j-7jhg-4f4c 4.6

Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-g3hp-vvqf-8vw6. This link is maintained to preserve external references.

Original Description

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Record
GHSA-9r7j-7jhg-4f4c
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
GitHub AdvisoriesGHSA-g3hp-vvqf-8vw6 1.8

Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page

Summary

A stored XSS vulnerability exists in the User Permissions page. The User Group name is rendered without proper HTML escaping in the permissions section, allowing an attacker to execute arbitrary JavaScript when another user views or edits a user's permissions.

[!NOTE] This is a separate vulnerability from the previously reported "Stored XSS via User Group Name in User Settings Page" and "Multiple Stored XSS in User Group Edit Page". This affects a different sink: the individual user's permissions page.

Proof of Concept

Required Permissions

Steps to Reproduce

  1. Log in to the control panel as an admin
  2. Navigate to Settings → Users → User Groups
  3. Create or edit a user group and set the Name field to: 
    <img src=x onerror="alert('XSS')" hidden>
  4. Save the user group
  5. Navigate to Users and edit any user (/admin/users/{id})
  6. Click on the Permissions tab
  7. XSS executes

Mitigation

Sanitize user group names when rendering in the user permissions template.

References

https://github.com/craftcms/cms-ghsa-4mgv-366x-qxvx/pull/2

Record
GHSA-g3hp-vvqf-8vw6
CVSS 4.0
1.8 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-79
Updated
2026-11-02
NVD 4.6

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Record
CVE-2026-56381
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 4.6

Craft CMS - Stored XSS via User Group Name in User Permissions Page

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Record
CVE-2026-56381
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-9r7j-7jhg-4f4c 4.6

Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-g3hp-vvqf-8vw6. This link is maintained to preserve external references.

Original Description

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Record
GHSA-9r7j-7jhg-4f4c
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-g3hp-vvqf-8vw6 1.8

Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page

Summary

A stored XSS vulnerability exists in the User Permissions page. The User Group name is rendered without proper HTML escaping in the permissions section, allowing an attacker to execute arbitrary JavaScript when another user views or edits a user's permissions.

[!NOTE] This is a separate vulnerability from the previously reported "Stored XSS via User Group Name in User Settings Page" and "Multiple Stored XSS in User Group Edit Page". This affects a different sink: the individual user's permissions page.

Proof of Concept

Required Permissions

Steps to Reproduce

  1. Log in to the control panel as an admin
  2. Navigate to Settings → Users → User Groups
  3. Create or edit a user group and set the Name field to: 
    <img src=x onerror="alert('XSS')" hidden>
  4. Save the user group
  5. Navigate to Users and edit any user (/admin/users/{id})
  6. Click on the Permissions tab
  7. XSS executes

Mitigation

Sanitize user group names when rendering in the user permissions template.

References

https://github.com/craftcms/cms-ghsa-4mgv-366x-qxvx/pull/2

Record
GHSA-g3hp-vvqf-8vw6
CVSS 4.0
1.8 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
craftcms/cms
Packagist
 5.0.0-RC1 to 5.8.21
5.8.22
craftcms/cms
Packagist
 5.0.0-RC1 up to 5.8.22, plus listed versions
5.0.05.0.15.0.25.0.35.0.4
Show 45 moreShow less
5.0.55.0.65.1.05.1.15.1.105.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-beta.15.2.0-beta.25.2.0-beta.35.2.0-beta.45.2.0-beta.55.2.0-beta.65.2.15.2.105.2.25.2.35.2.45.2.4.15.2.55.2.65.2.75.2.85.2.95.3.05.3.0-beta.15.3.0-beta.25.3.0.15.3.0.25.3.0.35.3.15.3.25.3.35.3.45.3.55.3.65.4.05.4.0.1
5.8.22

History

History
RecordedChangedSources
affected
affected, aliases, products, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56381 is a medium vulnerability (CVSS 4.6) in Craftcms Cms, published March 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in craftcms/cms 5.8.22.

References

This page doesn't list everything

Left out here: 92 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open