PT-2026-34219 · Craft Cms · Craft Cms

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41128

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.6.0 through 5.9.14

Description The 'actionSavePermissions()' endpoint allows a user possessing only viewUsers permission to remove arbitrary users from all user groups. This occurs because the saveUserGroups() function enforces authorization for adding users to groups but fails to perform an equivalent check for removals. Consequently, submitting an empty groups value results in the removal of all existing group memberships.

Recommendations Update to version 5.9.15.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-41128

GHSA-JQ2F-59PJ-P3M3

Affected Products

Craft Cms

References · 8

• https://osv.dev/vulnerability/GHSA-jq2f-59pj-p3m3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41128 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/commit/b135384808ad43fcf8836a9dd9b877fb0087bc27 · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-jq2f-59pj-p3m3 · Note
• https://twitter.com/infoflowcloud/status/2048169277136454050 · Twitter Post
• https://twitter.com/CVEnew/status/2048168404373406117 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046827877736354046 · Twitter Post