CVE-2026-36748 Details

A cross-site scripting (XSS) vulnerability has been identified in Rock RMS versions through 17.7.0. This issue allows for the execution of arbitrary JavaScript in the context of an administrator's browser session, potentially leading to unauthorized privilege escalation. The vulnerability arises from inadequate input sanitization in the Social Media Links feature of user profiles. When an administrator views a profile containing a crafted XSS payload, the payload executes and can escalate the profile owner's privileges to that of an administrator.

To mitigate this vulnerability, disable the Social Media Links feature within user profiles. This can be done by navigating to the Admin Settings, selecting General, and then accessing Person Attributes to uncheck the Active box for each social media type.