October CVE-2026-24906

CVSS 5.1 with vector AV:N/AC:L/PR:L/UI:P indicates network-accessible but requires low attack complexity, authenticated user (PR:L), and user interaction (UI:P). The scope is unchanged, and the impact is low to multiple attributes (VC:L, VI:L). While the base CVSS score is moderate, the stored XSS nature and privilege escalation scenario elevate real-world risk: an unprivileged editor can craft a payload that executes when a superuser later opens any RichEditor, potentially allowing session hijacking, CSRF attacks on behalf of the superuser, or direct privilege escalation via admin panel actions. Authentication requirement (PR:L) limits attack surface to users with backend access-a common but non-trivial barrier in many deployments. User interaction is required, but opening an editor during routine content work is expected behavior, making the UI:P less of a mitigating factor. The attack is highly automatable once a payload is crafted. Per SSVC logic, the technical impact is complete (privilege escalation), and exploitation is probable given the straightforward nature of XSS injection. This is a priority for environments where backend users span multiple trust levels (editors, contributors, admins).

An attacker with authenticated backend access and permission to modify editor settings (e.g., a rogue contributor or compromised editor account) injects a malicious JavaScript payload into one of the Markup Classes fields, such as: test' onload='fetch(/admin/users/1?name=attacker). When a superuser or other privileged user opens a RichEditor to edit a blog post or page, the Froala editor renders the unsanitized Markup Classes dropdown, executing the embedded JavaScript in the superuser's browser session. The attacker can then perform actions on behalf of the superuser, such as creating a new admin account or modifying security settings. The stored nature of the XSS means the payload persists and re-executes for every user who opens an editor, making it a highly effective privilege escalation vector.