{"id":"CVE-2026-111040","kind":"vulnerability","aliases":["CVE-2026-111040"],"related":[],"title":"Platform: stored HTML injection through TinyMCE editable fields","description":"The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.","summary":"An authenticated user with low privileges can store unsanitised HTML in editable fields managed by TinyMCE. That HTML is then rendered in other users' browsers, altering the content they see.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","tinymce","web-app"],"not_affected_if":["no-untrusted-editors"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:18+00:00","updated_at":"2026-11-04T10:27:18+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-04T10:27:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Platform: stored HTML injection through TinyMCE editable fields","impact":"medium","summary":"An authenticated user with low privileges can store unsanitised HTML in editable fields managed by TinyMCE. That HTML is then rendered in other users' browsers, altering the content they see.","audience":"businesses","category":"other","nicknames":[],"who_cares":["tinymce","web-app"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"other users' browsers render attacker-supplied HTML and script content","analyst_note":"Identify the affected platform and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111040; the description names no product.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-editors"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":4103,"output_tokens":370,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111040':11A,14A '-2026':10A,13A 'affect':86C 'allow':52C 'alter':45B 'app':19B 'applic':93C 'attack':64C 'authent':21B,63C 'browser':44B,85C 'content':47B,72C,90C 'cve':9A,12A 'databas':78C 'display':88C 'edit':7A,31B,57C 'field':8A,32B,58C 'html':3A,29B,37B,54C,71C 'inject':4A,55C,69C 'low':24B,66C 'manag':33B,59C 'persist':53C 'platform':1A,51C 'privileg':25B,67C 'render':40B,81C 'see':49B 'store':2A,27B,75C 'subsequ':80C 'tinymc':6A,16B,35B,61C 'unsanitis':28B,70C 'user':22B,43B,84C 'web':18B 'web-app':17B 'within':91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","tinymce","webapp"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111040","severity":null,"published_at":"2026-11-04T10:17:25+00:00","modified_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}