CVE-2026-66092— Stored XSS in pre-login notice via reachable legacy logon route

Quick assessment

Affected

Apereo Foundation openEQUELLA

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 openEQUELLA 2026.2 之前的版本中，登录前通知以 HTML 格式存储，并在传统的登录页面上直接渲染，未经过编码或清理处理。拥有权限的用户可通过接口设置包含任意脚本的通知，从而在登录页面引发存储型跨站脚本（Stored XSS）漏洞。若权限已授予“访客（Guest）”用户或“所有人（Everyone）”，则该漏洞可在无需认证的情况下被利用。

CVSS 4.8 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Stored XSS in pre-login notice via reachable legacy logon route

Source: CVE Program / CVE List V5

Vulnerability Description

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apereo Foundation	openEQUELLA	2019.1 ~ 2026.2	-

II. Public POCs for CVE-2026-66092

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-66092

请登录查看更多情报信息。

Other References for CVE-2026-66092 (2)

https://openequella.github.io/guides/ product
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-9jhj-7h37-3j2c vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-66092

Same Patch Batch · Apereo Foundation · 2026-10-29 · 6 CVEs total

CVE-2026-66088	9.4 CRITICAL	Unrestricted Command Execution via system.execute
CVE-2026-66090	7.1 HIGH	XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
CVE-2026-66091	6.9 MEDIUM	Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
CVE-2026-66089	6.1 MEDIUM	XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
CVE-2026-16889	4.8 MEDIUM	Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

IV. Related Vulnerabilities

Same product: openEQUELLA

Same vendor: Apereo Foundation

Same weakness: CWE-79