Medium severity · published Oct 29, 2026
CVE-2026-66092
Stored XSS in pre-login notice via reachable legacy logon route
New
4.8
CVSS
–
EPSS
No
On KEV
Description
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openEQUELLA · Apereo Foundation
2019.1 before 2026.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66092
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66092
vendor-advisory
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-9jhj-7h37-3j2c
product
https://openequella.github.io/guides/
More from openEQUELLA
9.4
CVE-2026-66088
Unrestricted Command Execution via system.execute
8.8
CVE-2026-67615
openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
7.1
CVE-2026-66090
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
6.9
CVE-2026-66091
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
6.1
CVE-2026-66089
XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion