openEQUELLA CVE-2026-66090

Requires an authenticated openEQUELLA account holding the CREATE_ITEM permission, which the attacker uses to submit crafted XML to the POST /api/item endpoint; the root condition is that the XML parser for item metadata does not disable external entity resolution. Exploitation is limited by that authentication/privilege requirement (PR:L - not anonymous) and by the attacker needing item-creation rights, so risk is highest on internet-exposed or multi-tenant deployments where untrusted or self-registered users can gain CREATE_ITEM. No user interaction is required and default behavior (external entities not disabled) is vulnerable on all versions before 2026.1. Impact scope includes any file readable by the openEQUELLA service account and any network location reachable by the server, notably cloud instance metadata services.

This is a genuine but authentication-gated issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reachability with low complexity and no user interaction, but PR:L confirms the attacker must already hold a valid account with the CREATE_ITEM privilege - exploitation is not anonymous. The primary impact is confidentiality (VC:H: arbitrary file read as the service account) plus a low subsequent-system impact (SC:L) reflecting SSRF reach into internal/cloud metadata endpoints; there is no integrity or availability impact in the vector. No EPSS score, KEV listing, or confirmed POC is present in the supplied data, so there is no signal of active or probable exploitation - the only urgency signal is the vendor/priority 'this_week' decision label, which is consistent with an authenticated, high-confidentiality XXE that is patchable. Net: a real priority to patch this week for internet-exposed or multi-tenant openEQUELLA instances where untrusted users can obtain item-creation rights, but it is not a wormable, unauthenticated mass-exploitation class issue. Missing data to note explicitly: EPSS probability is absent, KEV status is absent, and POC availability is unknown - none should be read as confirmed-safe.

An attacker with a low-privileged openEQUELLA account that carries the CREATE_ITEM permission submits a crafted XML item-metadata payload to POST /api/item containing an external entity definition. Because external entity resolution is not disabled, the server either returns the contents of a local file readable by the service account (for example configuration or credential files) or issues an attacker-directed request, including to a cloud instance metadata service to steal temporary credentials. No public exploit is identified in the supplied data, but XXE of this form is straightforward to weaponize once account access is obtained.