Medium severity4.8NVD Advisory· Published Jun 21, 2026· Updated Jun 23, 2026
CVE-2026-56381
CVE-2026-56381
Description
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
craftcms/cmsPackagist | >= 5.0.0-RC1, < 5.8.22 | 5.8.22 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-g3hp-vvqf-8vw6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-56381ghsaADVISORY
- github.com/craftcms/cms/releases/tag/5.8.22ghsaWEB
- github.com/craftcms/cms/security/advisories/GHSA-g3hp-vvqf-8vw6nvdWEB
- www.vulncheck.com/advisories/craft-cms-stored-xss-via-user-group-name-in-user-permissions-pagenvdWEB
News mentions
1- Craft CMS: Nine Vulnerabilities Including RCE and SSRF Disclosed in BatchVypr Intelligence · Jun 21, 2026