CVE-2026-56381: Craft CMS - Stored XSS via User Group Name in User Permissions Page
Published Jun 21, 2026
·Updated
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.
Affected Software
1 affected component
Pixel & Tonic Craft CMS>=5.0.0-RC1
Event History
Jun 21, 2026
CVE Published
via MITRE·01:26 PM
Data Sourced
via MITRE·01:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-56381?
CVE-2026-56381 has a medium severity rating of 4.8.
2
How do I fix CVE-2026-56381?
To fix CVE-2026-56381, update Craft CMS to the latest version where this vulnerability is patched.
3
What type of vulnerability is associated with CVE-2026-56381?
CVE-2026-56381 is a stored cross-site scripting (XSS) vulnerability.
4
Who is affected by CVE-2026-56381?
CVE-2026-56381 affects instances of Craft CMS from version 5.0.0-RC1 and later.
5
What can attackers do with CVE-2026-56381?
Attackers with admin access can inject and execute arbitrary JavaScript via the user group name field.