CVE-2026-49995 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.
A stored cross-site scripting vulnerability has been identified in Tautulli versions prior to 2.17.2. The issue arises because the newsletter cron field in the newsletters table is populated by the newsletter_config.html file without proper JSON encoding. An administrator or any user with a Tautulli API key can inject a malicious cron value. When another administrator opens the newsletter configuration modal, the injected script is executed in the Tautulli web context. This payload remains in the database and can continue to execute after credentials are rotated, until it is manually removed.
Users can update to Tautulli version 2.17.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-r6pg-vqxj-v75j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Tautulli/Tautulli/commit/12761b2d01e78f22e54e8ad8d3133931147cbb77 | [email protected] | Source CodeVendor |
| https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2 | [email protected] | Release NotesVendor |
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-r6pg-vqxj-v75j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tautulli | <= 2.17.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |