Stored Cross-Site Scripting Vulnerability in Craft CMS by Craft
CVE-2026-56381

4.6MEDIUM

Key Information:

Vendor: Craftcms
Status: Cms
Vendor: CVE Published:; 21 June 2026

What is CVE-2026-56381?

Craft CMS versions from 5.0.0-RC1 contain a stored cross-site scripting vulnerability located in the User Permissions page. This issue arises because user group names are rendered without the necessary HTML escaping. As a result, an attacker with admin access can inject custom JavaScript into the user group name field. This malicious script can execute when other users view or edit their permissions, potentially compromising sensitive information and user interactions within the application.

Affected Version(s)

cms 5.0.0-RC1 < 5.8.22

cms 5.8.22

References

https://github.com/craftcms/cms/security/advisories/GHSA-...

vendor-advisory

https://www.vulncheck.com/advisories/craft-cms-stored-xss...

third-party-advisory

CVSS V4

Score:

4.6

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 21, 2026
Vulnerability Reserved
Jun 21, 2026

Credit

mHe4am

CVE-2026-56381 Data

JSON