PT-2026-130614

CVE-2026-66092

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 4.0
4.8
Medium
MetricsAV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT SYSTEM SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT SYSTEM SETTINGS has been granted to the guest user or Everyone
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-66092
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com