XSS Vulnerability in Cachet Status Page System by CachetHQ
CVE-2026-113712

4.8MEDIUM

Key Information:

Vendor

Cachethq

Status
Cachet
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113712?

Cachet, an open-source status page system, has a stored XSS vulnerability in its incident creation form for versions 2.4.1 and earlier. This security flaw allows an authenticated user to inject malicious HTML or JavaScript into the status page. If another user views this page, the injected code could execute in their browser. This exploitation could lead to session token theft, thereby enabling potential account takeovers. The vulnerability was patched in commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2.

Affected Version(s)

cachet <= 2.4.1

References

https://github.com/cachethq/cachet/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/cachethq/core/commit/23adbb88ffa819f92...
x_refsource_MISC
https://github.com/cachethq/core/commit/57b44a8bac0b250b0...
x_refsource_MISC

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.