CVE-2026-72787: Craft CMS Stored XSS Vulnerability

CVE-2026-72787 Overview

CVE-2026-72787 is a stored cross-site scripting [CWE-79] vulnerability in Craft CMS versions before 5.10.8. The flaw exists in the control panel, where draft names are rendered without HTML encoding in element chips and cards. A low-privilege authenticated user who can create element drafts can inject JavaScript into a draft name. That payload executes in the browser of any higher-privileged user who views the affected element. Exploitation enables the attacker to perform authenticated actions in the victim's session, including account creation and privilege escalation through the admin interface.

Critical Impact
Authenticated low-privilege users can escalate to administrator by executing JavaScript in an admin's browser session, leading to unauthorized account creation and control panel takeover.

Affected Products

Craft CMS versions before 5.10.8
Craft CMS control panel (element chips and cards rendering)
Deployments that permit low-privilege users to create element drafts

Discovery Timeline

2026-08-12 - CVE-2026-72787 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72787

Vulnerability Analysis

The vulnerability resides in the Craft CMS control panel rendering logic for element chips and cards. Draft names supplied by users are inserted into the DOM without HTML entity encoding. Any user with permission to create drafts controls attacker-supplied text that later renders in another user's browser. When an administrator or higher-privileged reviewer opens an element list or dashboard that includes the malicious draft, the injected script executes in their authenticated session.

The stored nature of the flaw makes exploitation reliable. The payload persists in the database and triggers automatically each time the affected element is displayed. Because execution occurs inside the control panel origin, the script inherits full session privileges, including the ability to issue API calls, create new administrator accounts, modify content, and change site configuration.

Root Cause

The root cause is missing output encoding on the draft name field within the element chip and card Twig templates. The application treats the field as trusted display text rather than untrusted user input, bypassing the standard escaping applied elsewhere in the control panel.

Attack Vector

Exploitation requires network access to the control panel and low-privilege authenticated credentials with draft-creation rights. The attacker creates or renames a draft using a JavaScript payload as the draft name. When a higher-privileged user browses the element list, edit screen, or any view that renders the draft chip or card, the script executes. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for advisory details.

Detection Methods for CVE-2026-72787

Indicators of Compromise

Draft records whose title or name field contains HTML tags, <script> elements, or JavaScript event handlers such as onerror=, onload=, or onmouseover=.
Unexpected administrator or user accounts created shortly after control panel activity by a low-privilege account.
Control panel API requests originating from a session immediately after a draft view, particularly to user management endpoints.

Detection Strategies

Query the Craft CMS database for draft entries containing angle brackets or JavaScript keywords in name fields.
Review web server access logs for POST requests to draft creation and update endpoints followed by admin-session requests to user creation endpoints.
Correlate control panel authentication events with sudden privilege changes on user accounts.

Monitoring Recommendations

Enable audit logging for user and permission changes in Craft CMS and alert on new admin account creation.
Monitor Content Security Policy violation reports from the control panel origin for inline script execution attempts.
Track draft creation volume per user and flag accounts that submit unusually long or structured name values.

How to Mitigate CVE-2026-72787

Immediate Actions Required

Upgrade Craft CMS to version 5.10.8 or later without delay.
Audit existing drafts for malicious payloads in name fields and sanitize or delete affected records.
Review user accounts and permissions for unauthorized additions, and rotate credentials for any potentially exposed admin sessions.

Patch Information

Craft CMS resolved the issue in version 5.10.8 by applying HTML encoding to draft names when rendered in element chips and cards. Administrators should apply the update through Composer or the standard upgrade process documented in the GitHub Security Advisory.

Workarounds

Restrict draft-creation permissions to trusted users until the patch is applied.
Enforce a strict Content Security Policy on the control panel origin to block inline script execution.
Require higher-privileged reviewers to preview drafts only in isolated browser profiles without persistent admin sessions.

bash

# Upgrade Craft CMS via Composer
composer require craftcms/cms:^5.10.8 -w
php craft up