Countly Server CVE-2026-44977

The attacker must be an authenticated non-global application administrator on the Countly instance and must reach the star-rating plugin's uploadFeedbackFile upload path; exploitation succeeds because the pre-patch code trusts the client-supplied MIME type (myfile.type) and the frontend serves the stored file from feedback/preview/ with that attacker-controlled Content-Type. Payload execution additionally requires a global administrator to open the feedback preview (UI:R), so the attack cannot fire autonomously. Key limiting factors: valid app-admin credentials are required (not unauthenticated), the victim must be a higher-privileged global admin who actively opens the preview, and the issue is absent in versions 24.05.50 and 25.03.44 where MIME is derived from magic bytes and a safe-image allowlist and uploads are gated by validateGlobalAdmin/validateAppAdmin with the app_id pinned to the upload name.

This is a stored cross-site scripting flaw (CWE-79) in the Countly star-rating plugin with a vendor/NVD CVSS 3.1 score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). The high score is driven primarily by the scope change (S:C) and full CIA impact, which reflect a privilege-boundary crossing: a lower-privileged non-global application administrator plants content that ultimately executes in the session context of a higher-privileged global administrator. The practical risk is real but conditional rather than mass-exploitable: PR:L means the attacker must already hold application-admin credentials on the target instance, and UI:R means a global administrator must be induced to open the feedback preview before the payload fires. No EPSS score was supplied, so a quantitative exploitation-probability signal is unavailable. This is NOT a CISA KEV entry and no public exploit code was provided, so there is no evidence of active exploitation or weaponization - this looks like an insider/privilege-escalation XSS requiring a social-engineering step, not an internet-wide unauthenticated RCE. Net: a legitimately serious privilege-escalation issue for multi-tenant/multi-admin Countly deployments that should be patched, but the real-world urgency is lower than the 9.0 headline implies because of the authentication and user-interaction prerequisites. The provided CVSS vector is internally consistent with the description (network-delivered, low-privilege attacker, victim interaction, cross-privilege scope change).

A non-global application administrator on a shared Countly instance uses the star-rating plugin's uploadFeedbackFile endpoint to store an HTML/JavaScript file while supplying a trusted MIME type (e.g. text/html). When a global administrator later opens the feedback preview, the file is served from feedback/preview/ with the attacker-chosen Content-Type and the script executes in the Countly origin, exfiltrating the global admin's auth_token and csrf_token. No public exploit code was identified, but the fixing commit (ae899f3) publicly reveals the vulnerable MIME-trust logic, lowering the barrier to reproduce.