CVE-2026-56381: Stored XSS in Craft CMS User Permissions – CVSS 4.8

Technical summary

The vulnerability exists in Craft CMS's User Permissions interface due to insufficient HTML entity encoding of user group name fields. User group names are stored in the database and rendered directly into the DOM without sanitization when the permissions page is accessed. An attacker with administrative privileges can craft a user group name containing JavaScript payloads (e.g., <img src=x onerror=alert('xss')>). When any user with permission to view or edit user permissions loads the permissions page, the injected script executes in their browser context with their session privileges. The attack is stored, meaning the payload persists until the malicious group name is removed or the group is deleted.

Business impact

This vulnerability primarily affects organizations using Craft CMS where administrative accounts may be compromised or where insider threats exist. The attack enables privilege escalation and lateral movement—a malicious admin can steal session tokens, modify other user accounts, or inject further payloads targeting specific users. For content management platforms hosting sensitive data, this could lead to unauthorized content modification, credential theft, or website defacement. The impact is contained to users who interact with the permissions interface, but in many organizations, multiple administrators regularly review and modify user roles.

Affected systems

Craft CMS version 5.0.0-RC1 and later versions are affected. The vendor_products field in the source data is empty, indicating that no specific patch version or range has been formally documented in the advisory data available. Organizations should verify the exact affected version range and patch availability directly from Craft CMS security advisories or release notes.

Exploitability

Exploitation requires administrative access to the Craft CMS instance, which limits the attack surface significantly. The attacker must already have compromised or controlled a privileged account. No special exploit tools are needed—a simple JavaScript payload entered into a user group name field is sufficient. The user interaction requirement (another admin must view the permissions page) is a minor friction point but not a significant barrier in environments where permissions are regularly audited. Overall exploitability is moderate given the privilege requirement.

Remediation

Patch Craft CMS to a version that properly escapes or sanitizes user group names in the User Permissions interface. Until patching is possible, restrict administrative account access to trusted personnel, monitor admin account activity for suspicious behavior, and limit the number of users with permissions management privileges. As an interim control, review existing user groups for suspicious names containing HTML or JavaScript-like syntax.

Patch guidance

Check the official Craft CMS security advisories and release notes for the patched version addressing CVE-2026-56381. Apply the patch at your earliest opportunity, prioritizing instances where multiple administrators manage permissions. Test the patch in a non-production environment first to ensure compatibility with your CMS configuration and plugins. Because this requires admin access, the risk of accidental disruption during patching is low.

Detection guidance

Search user group names in your Craft CMS database and admin logs for suspicious patterns such as script tags, event handlers (onerror, onclick, onload), or encoded JavaScript. Monitor for admin accounts accessing the User Permissions page at unusual times or frequencies. Web application firewalls or reverse proxies in front of Craft CMS can also flag requests to the permissions endpoint containing HTML metacharacters, though this may generate false positives if legitimate group names contain special characters. Examine audit logs for user group creation or modification events coinciding with suspicious admin activity.

Why prioritize this

Despite a MEDIUM CVSS score, this vulnerability warrants prioritization because it enables attackers with admin access to compromise other users in the same system. The stored nature of the XSS means the attack persists and can affect multiple victims. In environments with shared or delegated administrative access, the risk of compromise is meaningful. However, the requirement for existing administrative privileges prevents this from being a critical internet-facing threat.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), but requiring high privileges to exploit (PR:H). The required user interaction (UI:R) from the victim and the scope change (S:C) with limited confidentiality and integrity impact (C:L/I:L) result in the MEDIUM severity. This scoring appropriately accounts for the privilege barrier while recognizing that once exploited, the impact crosses trust boundaries.

Frequently asked questions