StockAgile CVE-2026-6084

Requires a valid authenticated account on the target StockAgile instance (PR:L) with the ability to submit product-variant data to the REST endpoint '/inventory/configuration/variants' (fields such as 'code' and 'name'). Payload execution additionally requires a second authenticated user to view the affected management-panel page (UI:P), so it is not self-contained remote-unauthenticated exploitation. Limiting factors: attacker must first obtain panel credentials, impact is confined to the victim's browser session context (no direct server compromise, no availability impact, no scope change per the 4.0 vector), and a vendor patch is already available.

This is a moderate, not urgent, priority. The provided CVSS 4.0 base score is 5.1 (medium) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N. Two of the metrics materially cap real-world risk: PR:L means the attacker must already hold a valid authenticated account on the StockAgile instance, and UI:P (passive user interaction) means a legitimate authenticated user must subsequently view the poisoned management-panel page for the payload to fire. Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC referenced in the input, so there is no signal of active or automated exploitation. There is no SSVC decision data provided. The only strengthening signal is that the flaw was reported by a national CERT (INCIBE) and a vendor patch is available, which confirms the issue is real and validated rather than speculative. Impacts are limited (VC:L/VI:L, no availability impact, no scope change to other systems per the 4.0 vector), consistent with a stored XSS that runs in the browser context of panel users. Net: a genuine but bounded authenticated stored-XSS issue - patch on a normal cycle rather than emergency response.

An attacker who already has a low-privileged authenticated account on a StockAgile instance submits a product variant via the REST endpoint '/inventory/configuration/variants' with a malicious JavaScript payload placed in a text field such as 'code' or 'name'. The payload is stored unsanitized and later executes in the browser of any authenticated user who opens the corresponding management-panel view, enabling session/action abuse in that user's context. No public exploit code is identified at time of analysis.