Tautulli CVE-2026-49995

Requires the attacker to already possess Tautulli administrator access OR a valid Tautulli API key to write a crafted value into the newsletter 'cron' field (stored in the newsletters table). Execution is passive but conditional: a legitimate administrator must subsequently open the newsletter configuration modal in data/interfaces/default/newsletter_config.html, at which point the unescaped cron value runs as JavaScript. Limiting factors: high privilege prerequisite (admin or API key), required victim interaction (admin opening the specific modal), and the payload being confined to the Tautulli web/browser context rather than the server. Note the payload persists in the database and continues to fire even after API-key/credential rotation until the malicious newsletter entry is manually removed.

This is a genuinely LOW-priority stored XSS whose high-sounding CWE-79 label overstates real-world urgency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 4.8) tells the real story: exploitation requires PR:H - the attacker must already hold Tautulli administrator access or a valid Tautulli API key to write the malicious cron value - and UI:P, meaning payload execution only fires when an administrator later opens the newsletter configuration modal. The vulnerable-system impacts are all N; only the subsequent-system (browser) metrics SC:L/SI:L are set, reflecting limited script execution in the web context rather than server compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The one aggravating nuance the vendor flags - persistence across credential rotation, since the payload lives in the newsletters DB table until manually removed - raises cleanup importance but does not change the fact that an attacker who can plant it already possesses admin/API-key privilege. Net: real but low, and largely self-XSS-shaped (admin attacks admin) rather than a widespread remote threat. No signals conflict; the CVSS 4.0 vector, description, and source-code diff are mutually consistent.

An attacker who has obtained a Tautulli admin session or leaked API key stores a crafted newsletter cron value containing a JavaScript-breaking payload, which is persisted in the newsletters table. Later, when a legitimate administrator opens the newsletter configuration modal, the unescaped cron value is interpolated into a JavaScript string and executes in the Tautulli web context. No public exploit code is identified, but the vulnerable sink is confirmed by the vendor commit diff.