Sprout Clients CVE-2026-32424

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) indicates a network-accessible vulnerability with low attack complexity that requires low privileges (authenticated user) and user interaction (victims must view poisoned content). The scope change (S:C) indicates cross-boundary impact beyond the vulnerable component. While CVSS 6.5 suggests moderate severity, real-world risk is elevated by several factors: stored XSS typically poses higher risk than reflected variants, the authentication requirement filters out completely unauthenticated attackers, but insider threats or compromised accounts remain viable. Without confirmed KEV/CISA status or published proof-of-concept details, exploitation appears limited to opportunistic attackers or targeted campaigns. The requirement for victim interaction and stored payload setup suggests this is a priority for organizations using BoldGrid hosting, but not an immediate critical threat requiring emergency patching across all systems. Organizations should prioritize patching alongside other medium-severity web application vulnerabilities rather than treating as emergency.

An authenticated user (such as a compromised account or malicious employee) creates or edits a page/post in BoldGrid Sprout Clients and injects a JavaScript payload into a text field that is not properly sanitized. When other users (including administrators) view this page, the JavaScript executes in their browser context, potentially stealing session cookies, performing unauthorized actions, or redirecting to credential-harvesting sites. Since the attack is stored, it persists and affects all subsequent visitors until the malicious content is removed, making this significantly more dangerous than reflected XSS variants.