CVE-2026-56381 is a stored cross-site scripting vulnerability in Craft CMS 5.0.0-RC1. The issue occurs on the User Permissions page where user group names are not properly HTML-escaped before rendering. This allows attackers with admin access to inject malicious JavaScript code into the user group name field. When other users access the permissions page, the injected script executes, potentially leading to unauthorized actions or data exposure. The vulnerability requires administrative privileges to exploit and has a medium CVSS score of 4.6.

An attacker with administrative privileges can execute arbitrary JavaScript in the context of other users viewing or editing permissions. This could lead to session hijacking, unauthorized actions, or information disclosure within the CMS environment. However, exploitation requires admin-level access, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid using the affected version 5.0.0-RC1 in production environments.