Stored Cross-Site Scripting Vulnerability in openEQUELLA by Softworld
CVE-2026-66092

4.8MEDIUM

Key Information:

Vendor

Apereo Foundation

Status
Openequella
Vendor
CVE Published:
29 October 2026

What is CVE-2026-66092?

In openEQUELLA versions prior to 2026.2, a significant security issue arises from the handling of the pre-login notice, which is stored and rendered as HTML on the legacy login page without adequate encoding or sanitization. This vulnerability allows users with the EDIT_SYSTEM_SETTINGS permission to inject arbitrary scripts into the notice via the API endpoint (PUT /api/preloginnotice). The risk escalates as unauthenticated users may exploit this vulnerability if the EDIT_SYSTEM_SETTINGS permission has been inadvertently granted to guest users or all users, potentially leading to a stored cross-site scripting attack on the login interface.

Affected Version(s)

openEQUELLA 2019.1 < 2026.2

References

https://github.com/openequella/openEQUELLA/security/advis...
vendor-advisory
https://openequella.github.io/guides/
product

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyễn Tuấn Hùng ( University of Information Technology: VNUHCM - UIT )
Lê Ngọc Bảo Minh ( University of Information Technology: VNUHCM - UIT )
.