CVE-2026-56383 is a stored XSS vulnerability in Craft CMS affecting the editableTable.twig component's 'Row Heading' column type. The vulnerability occurs because the application fails to sanitize input within row heading default values, allowing an administrator-level attacker with allowAdminChanges enabled to inject arbitrary JavaScript. This script executes when other users view pages containing the affected table field. The vulnerability affects versions >=4.5.0-beta.1 through 4.16.18 and >=5.0.0-RC1 through 5.8.22 and is fixed in 4.16.19 and 5.8.23.

An attacker with administrator privileges and allowAdminChanges enabled can inject malicious JavaScript code that executes in the context of other users viewing the affected table field. This can lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. The CVSS 4.0 base score is 4.6 (medium severity), reflecting the need for administrator privileges and user interaction.

Upgrade Craft CMS to version 4.16.19 or later if using the 4.x branch, or to version 5.8.23 or later if using the 5.x branch, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.