StockAgile CVE-2026-6083

Requires a valid authenticated StockAgile account with at least low privileges (PR:L) to reach and write to the REST endpoint /inventory/configuration/pricing-tiers, and requires a second authenticated user to subsequently view the affected pricing-tier data in the management panel for the payload to execute (UI:P). Exploitation is limited by: the need for pre-existing authentication (not exploitable by unauthenticated outsiders), the dependency on victim interaction (a user must load the panel view), and access to an environment/tenant where the attacker can inject persistent text-field values. Impact is confined to script execution in the panel's browser context (VC:L/VI:L), with no availability impact.

This is a moderate, not urgent, priority. The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N - 5.1) accurately captures a network-reachable but authentication-gated (PR:L) stored XSS that also requires a victim to view the tainted panel (UI:P/passive interaction), with only Low confidentiality/integrity impact and no availability impact. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis - none of the escalating signals (mass-exploitation probability, known active exploitation, weaponized code) are present. The signals are internally consistent: a self/other-authenticated-user stored XSS in a management panel is a real but bounded issue, typically requiring an attacker to already hold a valid (even low-privilege) StockAgile account. This is a genuine flaw worth patching but is not a high-real-risk, internet-facing pre-auth issue; it reads as a solid moderate rather than a high-CVSS-but-low-real-risk inflation case. A patch is reported available via the INCIBE advisory, which lowers residual risk for organizations that update.

An attacker who already holds a low-privilege authenticated StockAgile account submits a pricing-tier via the REST endpoint /inventory/configuration/pricing-tiers with malicious JavaScript in the 'code', 'name', or another text field, which the server persists without proper validation. When another authenticated user (e.g., an admin or staff member) later opens the management panel where that pricing tier is rendered, the script executes in their browser session. No public exploit code is identified at time of analysis, but the injection path is straightforward.