CVE-2026-56383: Stored XSS in Craft CMS Editable Table Component

Technical summary

The editableTable.twig component in affected Craft CMS versions fails to perform proper output encoding on row heading default values. An authenticated user with administrator privileges (when allowAdminChanges is enabled) can inject arbitrary JavaScript into the component configuration. Because the payload is stored server-side and executed client-side without sanitization when the table is rendered, any user viewing a page containing the affected field becomes a potential victim. The attack vector is network-based with low complexity; exploitation requires high privilege (admin account) but only minimal user interaction (the victim simply viewing the page). The CVSS vector (4.8 MEDIUM) reflects limited impact—confidentiality and integrity are compromised, but availability is not affected, and the scope is changed (cross-site).

Business impact

This vulnerability poses a moderate insider threat and supply-chain risk. Compromised administrator accounts—whether through credential theft, social engineering, or malicious insiders—can be weaponized to inject payloads that silently harvest credentials or session tokens from other users. For multi-tenant or SaaS deployments of Craft CMS, a single compromised admin can impact dozens of end users without detection. Organizations relying on Craft for content management of high-value portals or customer-facing sites face reputational and compliance risk if user data is exfiltrated or sessions hijacked.

Affected systems

Craft CMS versions 4.5.0-beta.1 through 4.16.18 (stable 4.x branch) and 5.0.0-RC1 through 5.8.22 (stable 5.x branch) are vulnerable. Installations must have the allowAdminChanges configuration setting enabled for the vulnerability to be exploitable. Organizations running earlier versions (below 4.5.0-beta.1) or versions 4.16.19+ and 5.8.23+ are not affected. The vulnerability only manifests when an editable table field with a 'Row Heading' column type is present and rendered in the application UI.

Exploitability

Exploitation requires administrative credentials and deliberate configuration of a malicious payload in the row heading default value field. This is not a remote, unauthenticated attack. However, the barrier to exploitation within an organization is relatively low: any compromised or rogue administrator can inject the payload, and the attack is difficult to spot without code review or CSP auditing. Once injected, the payload persists and automatically executes for all non-admin users viewing that page, making it a high-impact persistence mechanism despite the high privilege requirement for initial injection.

Remediation

Upgrade immediately to Craft CMS 4.16.19 or later for the 4.x branch, or 5.8.23 or later for the 5.x branch. These versions include proper input sanitization and output encoding for row heading values. Additionally, review administrator account permissions and audit the allowAdminChanges setting—disable it if not required for your workflow. Conduct a forensic review of all editable table field configurations in your Craft installation to detect any suspicious or unusual row heading default values that may have been injected prior to patching.

Patch guidance

Patches are available in Craft CMS 4.16.19 and 5.8.23. Apply the version appropriate to your deployment branch. If you are on an intermediate version (e.g., 4.16.x or 5.8.x), update to the latest patch release within your branch. Test patches in a staging environment that mirrors your production editable table configurations to ensure compatibility with any custom extensions or plugins. The upgrade process is typically non-breaking for patch releases; refer to the official Craft CMS upgrade documentation for detailed steps. Monitor your change logs and file integrity checksums post-patch to confirm successful application.

Detection guidance

Search your Craft CMS database and configuration for any editable table fields with row heading column types. Inspect the raw field configuration (typically stored in the `fields` table) for suspicious JavaScript, event handlers, or encoded payloads in default value properties. Review administrator activity logs for modifications to field configurations, particularly editable table fields, especially by recently created or rarely-used admin accounts. Consider deploying a Web Application Firewall (WAF) rule to detect and log XSS payloads in POST requests to field configuration endpoints. Content Security Policy (CSP) headers can help mitigate the impact if a payload is executed, limiting script execution to trusted domains.

Why prioritize this

Although the CVSS score is MEDIUM (4.8), this vulnerability warrants high prioritization due to its persistence mechanism and insider threat angle. A single injected payload affects all downstream users indefinitely until discovered and removed. Organizations with strong administrator access controls and mature change management processes can deprioritize slightly; those with weaker IAM hygiene or high-risk admin user populations should patch within days. The fact that it is not yet in CISA's KEV catalog suggests limited in-the-wild exploitation, but the attack is straightforward for a motivated insider.

Risk score, explained

The CVSS 3.1 score of 4.8 (MEDIUM) appropriately reflects the high privilege requirement (PR:H) and required user interaction (UI:R), which reduce exploitability. However, the score does not fully capture the persistence and scope impact for multi-user environments. In isolation, a single compromised admin's injection may affect low-privileged users (low confidentiality and integrity impact), but in aggregate across a customer base or organization, the reputational and compliance risk is substantial. Security teams should apply environmental scoring adjustments upward if their Craft CMS instances store or process sensitive user data (PII, financial records, healthcare information).

Frequently asked questions