Skip to main content

NethServer WebTop CVE-2026-78331

HIGH
2026-08-24
Share

Severity by source

vuln.today AI
8.9 HIGH

Network-delivered stored XSS requiring authenticated attacker (PR:L) and victim browser interaction (UI:R); scope change to victim's origin context justifies S:C with high C/I and limited A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

2
Analysis Generated
Aug 24, 2026 - 18:20 vuln.today
CVE Published
Aug 24, 2026 - 16:12 oss-security
HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain or compromise low-privilege WebTop account
Delivery
Create calendar event with XSS payload in event fields
Exploit
Wait for target user to open poisoned calendar event
Execution
Payload executes in victim's browser context
Impact
Exfiltrate session token or perform unauthorized platform actions

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid, low-privilege authenticated account on the NethServer WebTop platform (confirmed by PR:L in the CVSS 4.0 vector) with sufficient rights to create or edit calendar events in the WebTop calendar component. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (High) is anchored by VC:H/VI:H/VA:H on the vulnerable system and SC:L/SI:L/SA:L on subsequent systems, reflecting that successful exploitation yields substantial impact to the victim's session and data but limited lateral propagation beyond the WebTop platform. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated WebTop user - such as a disgruntled employee or an attacker who has phished a valid account - creates a shared calendar event and embeds a JavaScript payload (e.g., a script that exfiltrates document.cookie to an attacker-controlled server) in the event title or description field. When a higher-privileged colleague, such as a platform administrator, opens their calendar and views the event, the payload fires in their browser, sending their session token to the attacker who then hijacks the session. …
Remediation Upgrade the WebTop module to version 1.5.7, which resolves both CVE-2026-78331 and the related CVE-2026-78332 per the vendor GitHub Security Advisory (GHSA-cqcv-5f3w-wpmr at https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr) and INCIBE advisory INCIBE-2026-578 (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all NethServer WebTop deployments and document current versions to assess exposure scope. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-78331 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy