CVE-2026-56381 is a stored cross-site scripting vulnerability in Craft CMS 5.0.0-RC1. The issue occurs on the User Permissions page where user group names are not properly HTML-escaped before rendering. An attacker with administrative privileges can inject JavaScript code via the user group name field. This code executes in the context of other users who access the permissions page, potentially leading to script execution within their browsers. The vulnerability has a CVSS 4.6 (medium) score and no known exploits in the wild. No official patch or remediation level has been provided as of the published date.

An attacker with admin privileges can inject arbitrary JavaScript code that executes in the browsers of other users who view or edit user permissions. This can lead to unauthorized actions performed on behalf of those users or theft of session information. The vulnerability requires high privileges (admin access) and user interaction (viewing/editing permissions). The overall impact is limited by these conditions but still poses a risk of cross-site scripting attacks within the administrative interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict admin access to trusted users only and avoid using user group names containing untrusted input. Monitor vendor channels for updates or patches addressing this vulnerability.