CVE-2026-56381

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 and later

Description A stored cross-site scripting issue exists in the User Permissions page. The software fails to properly perform HTML escaping when rendering user group names. This allows attackers with administrative privileges to inject arbitrary JavaScript through the user group name field, which then executes when other users view or edit permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.