Unrated severityNVD Advisory· Published Jun 21, 2026
Craft CMS - Stored XSS via User Group Name in User Permissions Page
CVE-2026-56381
Description
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/craftcms/cms/security/advisories/GHSA-g3hp-vvqf-8vw6mitrevendor-advisory
- www.vulncheck.com/advisories/craft-cms-stored-xss-via-user-group-name-in-user-permissions-pagemitrethird-party-advisory
News mentions
1- Craft CMS: Nine Vulnerabilities Including RCE and SSRF Disclosed in BatchVypr Intelligence · Jun 21, 2026