VulnSocial

CVE-2026-55790Disclosure

LOWCVSS 7.4 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-02: 2Technical Details · 2026-07-02: 207-02
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-55790 Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a… https://www.cve.org/CVERecord?id=CVE-2026-55790 ----- Traducción: CVE-2026-55790 Cra… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-55790 for Craft CMS, noting that attackers with a GitHub account can exploit a flaw in certain versions; no PoC, exploit code, active attacks, patch, or debunking information is provided.

    0000038
    91 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-55790 Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a… https://www.cve.org/CVERecord?id=CVE-2026-55790

    Post summary

    The text announces a critical CVE affecting Craft CMS versions 5.x and 4.x, noting that attackers can exploit the vulnerability using only a GitHub account, but no proof‑of‑concept or exploit code is discussed.

    00000751
    57.7K followersView on X

Explore more

Back to dashboard