T-Systems TAO CVE-2026-92976

Exploitation requires an authenticated TAO 2.0 account with the ability to edit the personal-data fields of the profile management functionality (PR:L). The injected HTML/JavaScript is persistently stored and only triggers when a second party - another user or administrative staff - subsequently views the affected profile (UI:P), so it is not fully self-triggering. There are no additional non-default configuration prerequisites stated; the limiting factors are the required authentication and the dependency on a victim viewing the malicious profile. Impact is scoped to the victim's browser session (session data access and actions with the victim's permissions), not the underlying server.

This is a real but modest-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network-reachable, low-complexity, authenticated (PR:L) exploitation that depends on a victim passively viewing the malicious profile (UI:P). Impact is confined to the subsequent system (the victim's browser session): SC:L/SI:L with no impact to the vulnerable system itself (VC:N/VI:N/VA:N), consistent with classic stored XSS. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor score of 5.1 (Medium) is reasonable - the authentication requirement and the need for another user to view the payload limit real-world blast radius. NOTE A DATA CONFLICT: the assigned CWE-613 (Insufficient Session Expiration) does not match the description, which unambiguously describes stored Cross-Site Scripting (CWE-79) - verify the weakness classification with the coordinator (INCIBE).

A low-privileged authenticated TAO 2.0 user edits their own profile and injects a malicious <script>/HTML payload into a personal-data field. The payload is stored and later executes in the browser of any user - including administrative staff - who views that profile, enabling session data theft or actions performed with the victim's privileges. No public exploit code is currently identified.