PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56381 craftcms CVE debrief

CVE-2026-56381 is a stored cross-site scripting (XSS) vulnerability in Craft CMS, affecting versions 5.0.0-RC1 and later. The vulnerability exists in the User Permissions page, where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field, which executes when other users view or edit permissions. The CVSS score for this vulnerability is 4.6, indicating a medium severity. Defenders should prioritize patching or mitigating this vulnerability to prevent potential attacks.

Vendor
craftcms
Product
cms
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-21
Original CVE updated
2026-06-23
Advisory published
2026-06-21
Advisory updated
2026-06-23

Who should care

Defenders responsible for Craft CMS installations, particularly those with admin access, should prioritize patching or mitigating this vulnerability. Additionally, users who view or edit permissions in the affected versions of Craft CMS may be impacted by successful exploitation.

Technical summary

The vulnerability exists in the User Permissions page of Craft CMS, where user group names are not properly HTML escaped. This allows attackers with admin access to inject arbitrary JavaScript via the user group name field. The injected JavaScript executes when other users view or edit permissions. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority due to CVSS score of 4.6 and potential for attacker exploitation.

Recommended defensive actions

  • Apply the official patch or update to a patched version of Craft CMS.
  • Review and limit admin access to the User Permissions page.
  • Implement compensating controls, such as web application firewalls (WAFs), to detect and prevent XSS attacks.
  • Monitor for suspicious activity and anomalies in user group name changes.
  • Perform inventory and verify affected versions of Craft CMS.

Evidence notes

The primary evidence for this vulnerability comes from the CVE-2026-56381 record and the NVD detail page. The vulnerability affects Craft CMS versions 5.0.0-RC1 and later. Defenders should verify the affected versions and apply patches or mitigations accordingly. The CVE record and NVD detail page provide additional information on the vulnerability, including the CVSS score and vector.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56381 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56381

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56381 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56381

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.