CVE-2026-41128 Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Attackers with viewUsers permission can remove arbitrary users from all groups due to missing authorization checks in the save-permissions action.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41128?
CVE-2026-41128 is a medium-severity missing authorization vulnerability in craftcms cms, published on 21 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with only `viewUsers` permission to remove arbitrary users from all user groups. While `_saveUserGroups()` enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty `groups` value removes all existing group memberships. Version 5.9.15 contains a patch.
Weakness: CWE-862
Which versions are affected by CVE-2026-41128?
2 open source packages ship an affected version, including craftcms/cms.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 5.6.0 | 5.9.15 |
craftcms/cms Packagist | From 5.6.0 | 5.9.15 |
How do I fix CVE-2026-41128?
Upgrade craftcms/cms to 5.9.15 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41128 being exploited?
There is no known exploitation of CVE-2026-41128 in the wild and no public exploit code.
Sources
Also known as GHSA-jq2f-59pj-p3m3.