CVE-2026-112066 Web Application - Stored XSS

A web application contains a stored XSS vulnerability caused by improper permission checks during JSON import of cookie consent configuration, letting non-admin backend users add arbitrary scripts to the frontend, exploit requires non-admin backend access.

CVSS base score 7.1 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Required
View the NVD record ↗

Details

Type
Stored XSS
Impact
Stored XSS, Client Script Exec
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
20 October 2026
Updated
20 October 2026
Weakness
CWE-862

Vendor fix

Restrict JSON import functionality to admin users only and validate permissions properly.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs