CVE-2026-72787 is a stored cross-site scripting vulnerability in Craft CMS prior to version 5.10.8. The issue arises from improper neutralization of input during web page generation, specifically in the control panel where draft names are rendered without HTML encoding in element chips and cards. This allows a low-privilege user capable of creating element drafts to inject malicious JavaScript code. When a higher-privileged user views the affected element, the injected script executes in their browser, potentially enabling unauthorized actions such as account creation and other authenticated operations.

The vulnerability enables a low-privilege user to execute arbitrary JavaScript in the browsers of higher-privileged users within the Craft CMS control panel. This can lead to unauthorized account creation and other actions performed with the privileges of the affected user. The impact is limited to users who have access to the control panel and view the affected elements. There is no indication of remote code execution or impact beyond the web interface context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 5.10.8, upgrading to version 5.10.8 or later is likely the intended remediation once officially released. Until a patch is confirmed, restrict low-privilege users from creating element drafts if possible and limit access to the control panel to trusted users.