Sisense Cloud BI CVE-2026-117493

Exploitation requires an authenticated account with sufficient privilege to create or edit BloX dashboard widgets through the /api/dashboards/<id>/widgets/<id> endpoint (PR:L), since the attacker must submit crafted HTML/JavaScript in the widget 'desc' or 'text' parameters. Because the payload is stored and only fires on render, a second user must open and view the affected widget for the script to execute (UI:A) - it is not fully automatic or self-contained. Limiting factors: attacker must already hold a valid low-privilege account on the platform, the BloX widget feature must be in use, and a victim must load the malicious widget; impact is bounded to data and actions available within the victim's authenticated browser context. This is therefore authenticated, interaction-dependent exploitation rather than remote unauthenticated attack against a default configuration.

This is a stored XSS (CWE-79) in Sisense Cloud BI Platform BloX widgets with a vendor-assigned CVSS 4.0 base score of 8.3. The vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L) signals network reach with low attack complexity, but it also requires attacker privileges (PR:L - an authenticated account able to write widget content) and passive victim interaction (UI:A - a user must render the malicious widget). The elevated score is driven largely by the subsequent-system confidentiality impact (SC:H), reflecting that injected script executes in the victim's authenticated browser session and can read data visible in that BI context. The decision signals pull in opposite directions: EPSS is low at 0.39% (33rd percentile), there is no CISA KEV listing and no public exploit referenced, yet vuln.today assigns a 'this_week' priority and a patch is already available. Net read: this is a genuine, patch-now authenticated stored-XSS in an enterprise analytics product rather than a mass-exploitation emergency - the low EPSS and absence of KEV/PoC argue against imminent widespread attack, while the this_week label and available fix argue for prompt remediation. No conflicting data between CVSS and description was identified; both describe authenticated, stored, browser-executed script affecting confidentiality.

An authenticated low-privilege user with rights to edit a dashboard submits a BloX widget via /api/dashboards/<id>/widgets/<id>, placing malicious HTML/JavaScript in the 'desc' or 'text' parameters. When another user (potentially higher-privileged) opens the dashboard, the stored script executes in their authenticated session and can exfiltrate data accessible in that BI context. No public exploit was identified at time of analysis; exploitation is plausible but requires both an attacker account and a victim viewing the widget (UI:A).