{"id":"CVE-2026-111037","kind":"vulnerability","aliases":["CVE-2026-111037"],"related":[],"title":"Coupa Supplier Portal: reflected script injection in Tenders module","description":"A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim’s browser. A successful exploit could allow the attacker to perform actions on the victim’s behalf, disclose accessible information or manipulate the user interface.","summary":"A parameter named list_item_function in the Tenders module of Coupa Supplier Portal is echoed back into a page without encoding, inside a JavaScript event handler. An attacker who gets a victim to open a crafted link can run scripts in the victim's browser session, acting as that user.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coupa","saas","supplier-portal","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:19+00:00","updated_at":"2026-11-04T10:27:19+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-04T10:27:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Coupa Supplier Portal: reflected script injection in Tenders module","impact":"medium","summary":"A parameter named list_item_function in the Tenders module of Coupa Supplier Portal is echoed back into a page without encoding, inside a JavaScript event handler. An attacker who gets a victim to open a crafted link can run scripts in the victim's browser session, acting as that user.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["coupa","supplier-portal","saas"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs scripts in victim's browser session, acting as the user","analyst_note":"Check the vendor's advisory or Coupa's status page for affected tenants, a fix or mitigation, and whether the Tenders module is in scope; the NVD entry alone gives no versions or fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations that use the Tenders module of the Coupa Supplier Portal as suppliers or buyers. The sources do not say which Coupa Supplier Portal versions or tenants are affected, and they do not describe how the vendor has responded.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4262,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111037':12A,15A '-2026':11A,14A 'access':176C 'account':133C 'act':69B 'action':169C 'allow':164C 'arbitrari':150C 'aris':94C 'attack':50B,127C,166C 'back':38B 'behalf':174C 'browser':67B,159C 'contain':139C 'context':120C,154C 'could':134C,163C 'coupa':1A,16B,33B,87C 'craft':58B 'creat':135C 'cross':76C 'cross-sit':75C 'cve':10A,13A 'direct':116C 'disclos':175C 'echo':37B 'embed':117C 'encod':43B,111C 'event':47B,124C 'execut':149C 'exploit':162C 'function':27B,99C 'get':52B 'handler':48B,125C 'inform':177C 'inject':6A 'insid':44B 'interfac':182C 'item':26B,98C 'javascript':46B,123C,140C 'link':59B 'list':25B,97C 'low':131C 'low-privileg':130C 'malici':137C 'manipul':179C 'modul':9A,31B,84C 'name':24B 'open':56B,144C 'output':110C 'page':41B 'paramet':23B,100C 'payload':141C 'perform':168C 'platform':91C 'portal':3A,20B,35B,89C 'privileg':132C 'proper':109C 'reflect':4A,74C,102C 'respons':107C 'run':61B 'saa':17B,90C 'sanitis':113C 'script':5A,62B,78C,151C 'server':105C 'session':68B 'site':77C 'success':161C 'supplier':2A,19B,34B,88C 'supplier-port':18B 'tender':8A,30B,83C 'url':138C 'user':72B,181C 'vendor':21B 'victim':54B,65B,147C,157C,172C 'vulner':80C,93C 'within':118C,152C 'without':42B,108C 'would':148C 'xss':79C","nicknames":[],"mitigations":[],"who_affected":"Organisations that use the Tenders module of the Coupa Supplier Portal as suppliers or buyers. The sources do not say which Coupa Supplier Portal versions or tenants are affected, and they do not describe how the vendor has responded.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coupa","medium","saas","supplierportal","vendor"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111037","severity":null,"published_at":"2026-11-04T10:17:24+00:00","modified_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}