openEQUELLA CVE-2026-66092

Requires an account holding the EDIT_SYSTEM_SETTINGS permission to set the pre-login notice via PUT /api/preloginnotice, and the deployment must present the legacy logon page where the unsanitised HTML notice is rendered; a victim must then load that login page for the stored script to execute (UI:P). Unauthenticated exploitation is possible only in the non-default case where EDIT_SYSTEM_SETTINGS has been granted to the guest user or the Everyone group. Limiting factors: the high privilege requirement in the default configuration, the dependence on the legacy logon page, the need for a victim to view the page, and that affected versions are openEQUELLA 2019.1 up to (but not including) 2026.2 - the complete fix is upgrading to 2026.2.

This is a medium-severity stored XSS (CVSS 4.0 base 4.8) whose real-world priority is modest. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows the two factors that hold risk down: PR:H means an attacker must already hold the EDIT_SYSTEM_SETTINGS permission to plant the payload, and UI:P means a victim must passively load the legacy logon page for the script to fire. Impact on the vulnerable system is nil (VC/VI/VA:N); only the subsequent user's browser context is affected at low confidentiality/integrity (SC:L/SI:L), consistent with session/credential theft rather than server compromise. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so exploitation-probability signals are absent rather than low - this should be stated as missing, not interpreted as safe. The vuln.today decision label is 'this_month' (not act_now/emergency), matching the moderate severity. One important nuance: the description states unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone, which conflicts with the PR:H in the base vector - the base vector reflects the default (privileged) case, while the unauthenticated path depends on a non-default, insecure permission grant and should be verified against each deployment's access-control configuration.

An actor holding the EDIT_SYSTEM_SETTINGS permission submits a pre-login notice containing a malicious script via PUT /api/preloginnotice; because the notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation, the script then executes in the browser of every user who loads that login page, enabling credential or session theft. Where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone, this can be performed without authentication. No public exploit identified at time of analysis.