{"action":"Upgrade craftcms/cms to 5.8.22 or later.","affected":[{"fixed":"5.8.22","introduced":"5.0.0-RC1"}],"component":"craftcms/cms","cve_ids":["CVE-2026-56381"],"ecosystem":"Packagist","epss":0.00181,"exploited":false,"fixed_versions":["5.8.22"],"ghsa_id":"GHSA-g3hp-vvqf-8vw6","id":"tcs_01M5KF28CX5N7DKXEPMM91FKK4","modified_at":"2026-08-06T21:45:58.093864387Z","published_at":"2026-03-11T14:56:59Z","references":["https://osv.dev/vulnerability/GHSA-g3hp-vvqf-8vw6","https://github.com/craftcms/cms/security/advisories/GHSA-g3hp-vvqf-8vw6","https://nvd.nist.gov/vuln/detail/CVE-2026-56381","https://github.com/craftcms/cms","https://github.com/craftcms/cms/releases/tag/5.8.22","https://www.vulncheck.com/advisories/craft-cms-stored-xss-via-user-group-name-in-user-permissions-page"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-g3hp-vvqf-8vw6","url":"https://osv.dev/vulnerability/GHSA-g3hp-vvqf-8vw6"},{"source":"nvd","source_id":"CVE-2026-56381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56381"}],"summary":"Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page"}