The vulnerability arises because the control-panel helper that renders element chip/card labels writes the element's draftName directly into the page without HTML encoding, while other path segments are encoded. A low-privilege user with permission to create drafts can inject a stored XSS payload in the draft name. When a higher-privileged user views the draft's chip or card in element indexes or relation fields, the payload executes in their control panel session. This enables the attacker to run arbitrary JavaScript, including reading the embedded CSRF token and issuing authenticated control panel actions as the victim, such as creating new admin accounts. The vulnerability is a cross-privilege stored XSS, not self-XSS, and affects routine control panel usage.

Allows a low-privilege user to execute arbitrary JavaScript in the session of higher-privileged control panel users, including administrators. This can lead to full control panel takeover by performing authenticated actions on behalf of the victim, such as creating new admin accounts. The attack requires the victim to view the affected draft's chip or card in the control panel, which is common during normal use. The vulnerability compromises the confidentiality and integrity of the control panel environment.

A patch is available for this vulnerability. Users should apply the official fix provided by the vendor to ensure the draftName is properly HTML-encoded before rendering. Until patched, restrict draft creation permissions to trusted users and avoid exposing draft chips/cards to higher-privileged users if possible. Check the vendor advisory for the official patch and remediation instructions.