CVE-2026-56381

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56381
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56381.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56381
Aliases
Published
2026-06-21T13:26:58.292Z
Modified
2026-07-08T08:13:50.347556249Z
Severity
  • 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Craft CMS - Stored XSS via User Group Name in User Permissions Page
Details

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56381.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
04755d93f86d07cc183db47db8a0eee106892e30
Fixed
8e23a7a14d50f169c10a487348c993384d479e06
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.8.22"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56381.json"