CVE-2026-7004

Name of the Vulnerable Software and Affected Versions WIT SynApps Runtime versions prior to 1.4.12

Description A pre-authentication reflected cross-site scripting issue exists where unauthenticated attackers can inject and execute arbitrary JavaScript. This is achieved by submitting a crafted LINK query parameter to the '/System/Session-1' endpoint. Exploitation can lead to credential harvesting, manipulation of the login flow, access to browser-visible data, and the execution of same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.

Recommendations Update WIT SynApps Runtime to version 1.4.12 or later. As a temporary mitigation, restrict access to the '/System/Session-1' endpoint or avoid using the LINK parameter.