Vulnerability Description
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.
Related Weaknesses (CWE)
References
- https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417
- https://github.com/craftcms/cms/security/advisories/GHSA-24x4-j6x9-rfw5
FAQ
What is CVE-2026-55790?
CVE-2026-55790 is a documented vulnerability. Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/...
How severe is CVE-2026-55790?
CVSS scoring is not yet available for CVE-2026-55790. Check NVD for updates.
Is there a patch for CVE-2026-55790?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.