Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 4.8, published 21 June 2026.
- Which products and versions are affected?
- craftcms/cms (Packagist) >= 5.0.0-RC1, <= 5.8.21.
- Is there a fix for This vulnerability?
- A patch was published on 2026-08-06: Duplicate advisory GHSA-9r7j-7jhg-4f4c withdrawn in favor of original report Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a network appliance.
- Am I affected?
- Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Craft CMS versions 5.0.0-RC1 through 5.8.21. The root cause is the failure to properly HTML-escape user group names when they are rendered on the individual User Permissions page (/admin/users/{id}). An attacker with administrative privileges can set a user group name to a malicious payload (e.g., using an <img> tag with an onerror attribute). When another user views or edits the permissions of a user belonging to that group, the payload executes in their browser session. This vulnerability is patched in version 5.8.22.
Affected products
- Pixel & Tonic Craft CMS >= 5.0.0-RC1, <= 5.8.21
Timeline
- 2026-03-09: advisory: Original advisory GHSA-g3hp-vvqf-8vw6 published
- 2026-06-21: disclosed: CVE-2026-56381 assigned and published
- 2026-08-06: patched: Duplicate advisory GHSA-9r7j-7jhg-4f4c withdrawn in favor of original report