CVE-2026-66092

CVSS 4.8 (medium) · published 2026-10-29

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone

Weakness: CWE-79

Source: NVD CVE-2026-66092

References

• https://github.com/openequella/openEQUELLA/security/advisories/GHSA-9jhj-7h37-3j2c
• https://openequella.github.io/guides/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.