CVE-2026-41128 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations, particularly those with user management and group permissions, should assess exposure and prioritize upgrading to version 5.9.15 or later. This includes administrators, security teams, and IT personnel managing Craft CMS deployments. They should verify user group permissions, monitor changes, and apply the patch to prevent unauthorized user group modifications.

Why it matters

CVE-2026-41128 allows unauthorized user group modifications in Craft CMS, requiring defenders to verify permissions, monitor changes, and upgrade to the patched version.

• Defenders need to verify user group permissions to prevent unauthorized modifications.
• User group changes may require monitoring to detect potential exploitation.
• Upgrading to version 5.9.15 or later is necessary to apply the patch.

Technical summary

The `actionSavePermissions()` endpoint in Craft CMS versions 5.6.0 through 5.9.14 allows a user with only 'viewUsers' permission to remove arbitrary users from all user groups by submitting an empty 'groups' value. This is due to a lack of authorization checks for removals, unlike additions which enforce per-group authorization. The patched version, 5.9.15, addresses this vulnerability by adding necessary authorization checks for user group removals, thus preventing unauthorized modifications of user group memberships.

Defensive priority

Defenders should prioritize verifying user group permissions and upgrading to version 5.9.15 or later.

Recommended defensive actions

• Verify user group permissions to prevent unauthorized modifications.
• Upgrade to Craft CMS version 5.9.15 or later to apply the patch.
• Monitor user group changes to detect potential exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and patched version. The vulnerability was patched in version 5.9.15 of Craft CMS. Evidence is limited to public CVE and NVD records, which may not cover all potential deployments or configurations. Defenders should verify user group permissions and monitor changes to detect potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.