SB2026061669 - Multiple vulnerabilities in Craft CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026061669

SB2026061669 - Multiple vulnerabilities in Craft CMS

Published: June 16, 2026

Security Bulletin ID SB2026061669
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Missing Authorization (CVE-ID: CVE-2026-41128)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to remove arbitrary users from all user groups.

The vulnerability exists due to improper access control in the actionSavePermissions() endpoint and _saveUserGroups() method when handling a crafted save-permissions request with an empty groups value. A remote user can send a specially crafted POST request to remove arbitrary users from all user groups.

Exploitation requires a control panel account with accessCp and viewUsers permissions, and only Pro edition or higher is affected.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-41129)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to access internal services via server-side request forgery.

The vulnerability exists due to server-side request forgery in the GraphQL asset upload mutations when processing user-supplied asset URLs. A remote user can supply a crafted gopher URL to access internal services via server-side request forgery.

Exploitation requires GraphQL schema permissions to edit assets in the volume and create assets in the volume.


3) Input validation error (CVE-ID: CVE-2026-41130)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper input validation in AppController::actionResourceJs() when handling requests to the resource-js endpoint with a crafted Host header and url parameter. A remote attacker can send a specially crafted request to perform server-side request forgery.

Exploitation requires the default configuration where trustedHosts is not explicitly restricted.


Remediation

Install update from vendor's website.

References