CVE-2026-41128: Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the actionSavePermissions() endpoint allows a user with only viewUsers permission to remove arbitrary users from all user groups. While saveUserGroups() enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty groups value removes all existing group memberships. Version 5.9.15 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41128?
CVE-2026-41128 has been classified as a medium severity vulnerability due to the potential impact of unauthorized user removals.
How do I fix CVE-2026-41128?
To fix CVE-2026-41128, upgrade Craft CMS to version 5.9.15 or later where the issue is resolved.
Who is affected by CVE-2026-41128?
CVE-2026-41128 affects users of Craft CMS versions 5.6.0 through 5.9.14.
What is the attack vector for CVE-2026-41128?
The attack vector for CVE-2026-41128 is through the actionSavePermissions() endpoint which can be exploited by users with only 'viewUsers' permission.
What are the consequences of CVE-2026-41128?
The consequences of CVE-2026-41128 include unauthorized removal of users from groups, potentially disrupting access control.