Which versions of Craft CMS are affected by CVE-2026-55790?

Craft CMS administrators using versions 4.0.0-RC1 through 4.17.15 or 5.0.0-RC1 through 5.9.22 face session hijacking via externally-injected malicious code in the GitHub support feedback interface,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55790?

Yes, a public proof-of-concept exploit is available for CVE-2026-55790. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55790?

Within 24 hours: Audit all Craft CMS installations for affected versions (4.x: up to 4.17.15; 5.x: up to 5.9.22); disable or restrict the CraftSupport plugin; establish emergency access logging for administrator control panel use. Within 7 days: Implement Content Security Policy headers, restrict admin access to known IP ranges/VPN, enforce multi-factor authentication for all admin accounts. Within 30 days: Monitor Craft CMS security advisories for patch availability; apply vendor-released patch immediately upon availability; retire mitigations once patched version is deployed.

Craft CMS CVE-2026-55790

Q: What is the CVSS score of CVE-2026-55790?

CVE-2026-55790 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41209 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 security-advisories@github.com

GHSA-24x4-j6x9-rfw5

XSS

7.4

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

PR:N since the attacker only needs a GitHub account; AC:H and UI:R because an admin must search a term surfacing the poisoned issue; S:C as script runs cross-context in the CP session with high C/I impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 01, 2026 - 23:31 vuln.today

DescriptionCVE.org

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.

AnalysisAI

Stored cross-site scripting in the Craft CMS control panel lets an attacker holding only a free GitHub account run JavaScript in an administrator's authenticated session. The payload is planted in the title of a craftcms/cms GitHub issue and executes when a Craft admin uses the CraftSupport widget's 'Give feedback' screen and searches a term that surfaces the poisoned issue. Affects Craft CMS 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15; no public exploit identified at time of analysis, and it is not in CISA KEV.

Technical ContextAI

Craft CMS is a PHP-based content management system whose administrative control panel embeds a CraftSupport widget that lets admins search and file feedback against the upstream craftcms/cms GitHub repository. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): GitHub issue titles returned by the search API are rendered into the control panel DOM without adequate output encoding, so HTML/JavaScript in a title is interpreted rather than displayed as text. Because issue titles are controllable by anyone with a free GitHub account, the trust boundary is crossed - untrusted third-party data (a public issue title) is reflected into a privileged first-party context (the admin CP session).

RemediationAI

Vendor-released patch: upgrade to Craft CMS 4.17.16 (4.x line) or 5.9.23 (5.x line), which fix the issue per advisory GHSA-24x4-j6x9-rfw5 (https://github.com/craftcms/cms/security/advisories/GHSA-24x4-j6x9-rfw5); the code change is in commit 6bbb66038a268552180ca5c8eed9f46ea25a4417. Until patched, the practical compensating control is to avoid using the CraftSupport widget's 'Give feedback' search on unpatched installs - admins should not run feedback searches, which removes the trigger path (trade-off: loss of the in-panel support/feedback workflow). A defense-in-depth measure is a strict Content-Security-Policy on the control panel to restrict inline script execution, though CSP tuning can break legitimate CP functionality and should be tested first. Reducing the number of control panel admin accounts also shrinks the pool of potential victims.