CVE-2026-66089: XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion

Severity: medium (CVSS 6.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-29 · updated 2026-10-29
Weakness: CWE-611

Description

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

Affected products

Apereo Foundation openEQUELLA: before 2026.1 — fixed in 2026.1

How to fix

Upgrade to a fixed version: Apereo Foundation openEQUELLA 2026.1. Check the vendor advisory for mitigations.

References

https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45
https://openequella.github.io/guides/

Get alerted when CVE-2026-66089 or the next vulnerability affects your stack