Persistent HTML Injection in TinyMCE Editor on Coupas Platform

CVE-2026-111040

What is CVE-2026-111040?

The Coupas Total Spend Management Platform is vulnerable to a persistent HTML injection flaw, allowing authenticated attackers with minimal privileges to inject unsanitized HTML content into editable fields. This malicious content is stored in the database and later rendered in the browsers of other users, potentially leading to unwanted alterations in the display and functionality of content within the application.

References