CVE-2026-56381: Craft CMS Stored XSS Vulnerability

CVE-2026-56381 Overview

CVE-2026-56381 is a stored cross-site scripting (XSS) vulnerability in Craft CMS starting from version 5.0.0-RC1. The flaw exists in the User Permissions page, where user group names are rendered without proper HTML escaping. An attacker with administrative access can inject arbitrary JavaScript into the user group name field. The payload executes in the browser of any user who subsequently views or edits permissions. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated administrators can store JavaScript that executes against other administrators, enabling session theft, privilege abuse, and persistent compromise of the Craft CMS control panel.

Affected Products

Craft CMS version 5.0.0-RC1 and later releases prior to the fix
Craft CMS control panel User Permissions page
Installations with multiple administrative users managing user groups

Discovery Timeline

2026-06-21 - CVE-2026-56381 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56381

Vulnerability Analysis

The vulnerability resides in the Craft CMS control panel, specifically in the rendering logic for the User Permissions page. When a Craft CMS administrator creates or edits a user group, the application stores the group name in the database. When the User Permissions page is later rendered, the application outputs the stored group name into the HTML response without applying HTML entity encoding. Any markup or script content placed in the group name is treated as live HTML by the browser.

Because the malicious payload is persisted in the database, it executes for every user who loads the page. This pattern matches a classic stored XSS scenario, where the application trusts data that originated from a privileged user input field.

Root Cause

The root cause is missing output escaping in the template responsible for rendering user group names on the User Permissions page. Craft CMS uses Twig templates that escape variables by default, but the affected output path renders the group name as raw HTML. The application does not sanitize the group name on input either, so the injected script survives storage and retrieval intact.

Attack Vector

Exploitation requires an attacker who already holds high privileges within the Craft CMS instance. The attacker creates or renames a user group and embeds a JavaScript payload in the group name field. The payload executes when another administrator opens the User Permissions page or edits the affected group. The script runs in the victim's authenticated session context, enabling actions such as creating new admin accounts, exfiltrating CSRF tokens, or modifying site content. User interaction is required because the victim must navigate to the affected page.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory and the VulnCheck Advisory for vendor technical detail.

Detection Methods for CVE-2026-56381

Indicators of Compromise

User group names containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=
Unexpected outbound HTTP requests from administrator browsers to unfamiliar domains after visiting the User Permissions page
Newly created administrator accounts or unexplained permission changes following access to the User Permissions page

Detection Strategies

Query the Craft CMS database for entries in the user groups table whose name column contains angle brackets, quotes, or JavaScript scheme strings
Inspect Craft CMS audit logs for usergroups/save-group actions performed by administrators outside expected change windows
Monitor web server access logs for requests to /admin/users/groups and correlate with subsequent anomalous administrator actions

Monitoring Recommendations

Enable browser Content Security Policy (CSP) reporting endpoints to capture script execution violations originating from the Craft CMS admin path
Alert on changes to administrator accounts, permission assignments, and user group definitions in near real time
Review web application firewall (WAF) logs for payloads matching XSS signatures submitted to user group endpoints

How to Mitigate CVE-2026-56381

Immediate Actions Required

Upgrade Craft CMS to the patched release identified in the GitHub Security Advisory GHSA-g3hp-vvqf-8vw6
Audit existing user group names and remove any that contain HTML or JavaScript content
Rotate session tokens and credentials for administrators who may have accessed a tampered User Permissions page

Patch Information

Craft CMS has issued a security advisory under identifier GHSA-g3hp-vvqf-8vw6. The fix applies proper HTML escaping to user group names on the User Permissions page. Administrators should consult the advisory for the exact fixed version and follow the standard Craft CMS upgrade procedure using composer update craftcms/cms.

Workarounds

Restrict administrator account creation and limit the number of users who can create or modify user groups
Enforce a strict Content Security Policy on the Craft CMS control panel to block inline script execution
Manually sanitize user group names by editing them to remove any HTML markup until the patch is applied

bash

# Upgrade Craft CMS to the patched release
cd /path/to/craft-project
composer update craftcms/cms --with-dependencies
php craft migrate/all
php craft clear-caches/all