Auth bypass in Craftcms Cms

CVE-2026-41128

Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with only `viewUsers` permission to remove arbitrary users from all user groups. While `_saveUserGroups(…

Vulnerability class: Broken Access Control

EPSS: 0.002 (16.2th percentile) — read the EPSS interpretation.