Executive brief
Craft CMS, a popular content management system, is vulnerable to a security flaw where malicious code can be hidden within a User Group name. If an administrator views the permissions page for a user belonging to that group, the hidden code will execute in their browser. This could allow an attacker with administrative access to perform unauthorized actions or manipulate data by exploiting the trust of other administrators.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Craft CMS versions 5.0.0-RC1 through 5.8.21. The root cause is the failure to properly HTML-escape User Group names when they are rendered within the individual User Permissions template. An attacker with administrative access (specifically the ability to manage User Groups) can inject a malicious payload into the group name field. The payload is executed when another administrator navigates to the 'Permissions' tab of any user belonging to that group. This vulnerability is distinct from previous XSS issues in the User Settings or User Group Edit pages. A fix is available in version 5.8.22.
Affected products
- Pixel & Tonic Craft CMS >= 5.0.0-RC1, <= 5.8.21
Timeline
- 2026-03-09: disclosed
- 2026-03-11: advisory
- 2026-03-11: patched: Fixed in version 5.8.22