Cloudron CVE-2026-79363

Requires an authenticated Cloudron administrator account able to edit the Branding Footer setting, where crafted HTML with JavaScript event handlers is stored. Execution is triggered only when the stored value is rendered on the public login / OpenID interaction page (viewed by unauthenticated users) or in the System Event Log (viewed by operators), so a victim must load one of those pages (UI:R). Key limiting factor: the inject step demands administrator privileges, a high trust bar that confines the initial attacker to insiders or already-compromised admin accounts; impact is confined to Cloudron 9.1.7 and 9.2 with the Branding Footer feature in use.

This is a medium-severity stored XSS (CVSS 5.9, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) that should be treated as a moderate, not top, priority. The single most important limiting signal is PR:H: an attacker must already hold authenticated administrator access to write the Branding Footer setting, which is a high trust bar and sharply reduces real-world risk - a malicious admin already has broad control. The offsetting signals are AV:N, AC:L, S:C and the injection point: the payload executes on the PUBLIC, unauthenticated login/OpenID interaction page and in the System Event Log, so it crosses a privilege boundary from an admin-controlled setting into the browsers of unauthenticated end users and other operators (this is what justifies S:C and makes it more than a self-XSS). EPSS score is not provided in the input, KEV status is NO (not in CISA KEV), and POC availability is unconfirmed - the two faydin.blog references are likely a researcher write-up rather than confirmed weaponized exploit code. No signals conflict with the CVSS vector; the description's 'authenticated administrator' requirement is consistent with PR:H. Net: a legitimate but lower-urgency patch item - meaningful because it pivots admin-only input into code execution against unauthenticated visitors, but gated behind administrative access and requiring a victim to view the affected page.

A compromised or rogue Cloudron administrator stores a crafted HTML event handler (e.g. an onerror/onload payload) in the Branding Footer setting. When any unauthenticated user subsequently loads the public login or OpenID interaction page - or an operator views the System Event Log - the stored JavaScript executes in the Cloudron web origin, enabling session/token theft, credential harvesting on the login form, or UI manipulation. No public exploit code has been confirmed, though a researcher write-up appears to exist.