Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
Craft CMS version 5.0.0-RC1 contains a stored cross-site scripting (XSS) vulnerability in the User Permissions page. The vulnerability arises because user group names are rendered without proper HTML escaping. An attacker with administrative privileges can inject arbitrary JavaScript code via the user group name field, which executes when other users view or edit permissions. This advisory is a duplicate and has been withdrawn in favor of GHSA-g3hp-vvqf-8vw6.
AI Analysis
Technical Summary
Craft CMS from version 5.0.0-RC1 is affected by a stored cross-site scripting vulnerability (CWE-79) in the User Permissions page. The issue occurs because user group names are not properly escaped before rendering, allowing attackers with admin access to inject malicious JavaScript code. This code executes in the context of other users who view or edit permissions, potentially leading to session hijacking or other client-side impacts. The advisory is a duplicate of GHSA-g3hp-vvqf-8vw6 and has been withdrawn to preserve external references.
Potential Impact
The vulnerability allows an attacker with administrative privileges to execute arbitrary JavaScript in the browsers of other users who access the User Permissions page. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of the user interface. There is no indication of availability impact. The CVSS score is 4.8 (medium severity) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Mitigation Recommendations
No patch or official fix information is provided in this advisory. Patch status is not yet confirmed — check the vendor advisory GHSA-g3hp-vvqf-8vw6 for current remediation guidance. Until a fix is applied, restrict administrative access to trusted users only and consider monitoring for suspicious activity related to user group name changes.
Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
Description
Craft CMS version 5.0.0-RC1 contains a stored cross-site scripting (XSS) vulnerability in the User Permissions page. The vulnerability arises because user group names are rendered without proper HTML escaping. An attacker with administrative privileges can inject arbitrary JavaScript code via the user group name field, which executes when other users view or edit permissions. This advisory is a duplicate and has been withdrawn in favor of GHSA-g3hp-vvqf-8vw6.
CVSS v3.1
Score 4.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Craft CMS from version 5.0.0-RC1 is affected by a stored cross-site scripting vulnerability (CWE-79) in the User Permissions page. The issue occurs because user group names are not properly escaped before rendering, allowing attackers with admin access to inject malicious JavaScript code. This code executes in the context of other users who view or edit permissions, potentially leading to session hijacking or other client-side impacts. The advisory is a duplicate of GHSA-g3hp-vvqf-8vw6 and has been withdrawn to preserve external references.
Potential Impact
The vulnerability allows an attacker with administrative privileges to execute arbitrary JavaScript in the browsers of other users who access the User Permissions page. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of the user interface. There is no indication of availability impact. The CVSS score is 4.8 (medium severity) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Mitigation Recommendations
No patch or official fix information is provided in this advisory. Patch status is not yet confirmed — check the vendor advisory GHSA-g3hp-vvqf-8vw6 for current remediation guidance. Until a fix is applied, restrict administrative access to trusted users only and consider monitoring for suspicious activity related to user group name changes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9r7j-7jhg-4f4c
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a7573bbbf8831d539d94180
Added to database: 08/07/2026, 05:57:15 UTC
Last enriched: 08/07/2026, 07:01:19 UTC
Last updated: 08/07/2026, 07:01:19 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.