CVE-2026-41128

Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with only `viewUsers` permission to remove arbitrary users from all user groups. While `_saveUserGroups()` enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty `groups` value removes all existing group memberships. Version 5.9.15 contains a patch.

• CWE-862

• https://github.com/craftcms/cms/commit/b135384808ad43fcf8836a9dd9b877fb0087bc27
• https://github.com/craftcms/cms/security/advisories/GHSA-jq2f-59pj-p3m3

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41122Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.1
• CVE-2026-41123Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…4.3
• CVE-2026-41124Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…4.4
• CVE-2026-41125A vulnerability has been identified in blueplanet 100 NX3 M8…6
• CVE-2026-41126BigBlueButton is an open-source virtual classroom. Versions …4.3
• CVE-2026-41127BigBlueButton is an open-source virtual classroom. Versions …6.5
• CVE-2026-41129Craft CMS is a content management system (CMS). Versions on …5.5
• CVE-2026-4113An observable response discrepancy vulnerability in the Soni…7.2
• CVE-2026-41130Craft CMS is a content management system (CMS). In versions …5.5
• CVE-2026-41131OpenFGA is an authorization/permission engine built for deve…5
• CVE-2026-41132CKAN is an open-source DMS (data management system) for powe…7.4
• CVE-2026-41133pyLoad is a free and open-source download manager written in…8.8