Vulnerability · Published Jun 21, 2026 · Assigned by VulnCheck

CVE-2026-56381Craft CMS - Stored XSS via User Group Name in User Permissions Page

Medium 4.8

In plain English

A medium-severity cross-site scripting in cms from craftcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 92.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	5.8.22	GHSA-g3hp-vvqf-8vw6

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	5.0.0-RC1 – before 5.8.22

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

GHSA Advisory GHSA-g3hp-vvqf-8vw6 vendor-advisory
VulnCheck Advisory: Craft CMS - Stored XSS via User Group Name in User Permissions Page third-party-advisory