What’s Vulnerable › Vulnerabilities

CVE-2026-66092: Stored XSS in pre-login notice via reachable legacy logon route

• Severity: medium (CVSS 4.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-29 · updated 2026-10-29
• Weakness: CWE-79

Description

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone

Affected products

• Apereo Foundation openEQUELLA: from 2019.1 before 2026.2 — fixed in 2026.2

How to fix

Upgrade to a fixed version: Apereo Foundation openEQUELLA 2026.2. Check the vendor advisory for mitigations.

References

• https://github.com/openequella/openEQUELLA/security/advisories/GHSA-9jhj-7h37-3j2c
• https://openequella.github.io/guides/

Get alerted when CVE-2026-66092 or the next vulnerability affects your stack