CVE-2026-66092 Details
Description
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone
A stored cross-site scripting vulnerability has been identified in openEQUELLA versions 2019.1 prior to 2026.2. This issue arises because the pre-login notice is saved as HTML and displayed on the legacy login page without proper encoding or sanitization. Users with the EDIT_SYSTEM_SETTINGS permission can inject arbitrary scripts into the notice, which are then executed for all users who access the login page. This vulnerability can be exploited without authentication if the EDIT_SYSTEM_SETTINGS permission is granted to the guest user or the Everyone group.
Users should ensure that the EDIT_SYSTEM_SETTINGS permission is only granted to trusted administrators and not to the guest user or the Everyone group. After updating to openEQUELLA version 2026.2.0, which includes a fix for this vulnerability, no additional actions are required.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openequella/openEQUELLA/security/advisories/GHSA-9jhj-7h37-3j2c | MON-CSIRT | AdvisoryRemedyVendor |
| https://openequella.github.io/guides/ | MON-CSIRT | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | MON-CSIRT |
Affected Products
| Product | Versions |
|---|---|
| openEQUELLA | >= 2019.1, < 2026.2.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | MON-CSIRT |