openEQUELLA CVE-2026-66089

Requires an authenticated low-privilege account (PR:L) able to invoke the openEQUELLA SOAP API, and specifically the stopEdit operation, whose XML input is parsed with external-entity resolution enabled. The AT:P metric and the stopEdit semantics indicate a precondition - most plausibly an active/open edit session on an item - that the attacker does not fully control; the available sources do not spell out this precondition in detail, so it is inferred rather than confirmed. Limiting factors: exploitation is not unauthenticated, is confined to deployments before 2026.1, and depends on the stopEdit XML path being reachable for the attacker's privilege level; impact is bounded to files readable by the service account and to SSRF targets reachable from the server.

This is a genuine but moderate-priority issue rather than an emergency. The sole CVSS signal provided is a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N, score 6.1): network-reachable, but gated by PR:L (a valid low-privilege account) and AT:P (a non-attacker-controlled precondition, consistent with needing an active edit session for the stopEdit operation). The high vulnerable-system confidentiality (VC:H) reflects arbitrary file read, and SC:L plus the SSRF behavior reflect reach into adjacent systems. No EPSS score, no CISA KEV listing, and no SSVC exploitation/automatable values were supplied, and no PoC or exploit reference is present in the input - so exploitation probability cannot be quantified from the data. The vuln.today decision label is 'this_month', which aligns with a patched, authenticated, condition-gated flaw rather than an act_now/emergency item. No CVSS 3.1 vector was provided for cross-check; the only base metrics come from the 4.0 vector, so attack-complexity and privilege claims rest on that single source plus the description.

An attacker holding a low-privilege authenticated account on openEQUELLA sends a crafted XML document to the SOAP API's stopEdit operation, embedding an external entity that references a local file path or an internal URL. The entity-resolving parser dereferences it, returning the contents of files readable by the openEQUELLA service account or forcing the server to issue attacker-directed requests (SSRF). No public exploit code is identified in the available data.