{"id":"CVE-2026-113808","kind":"vulnerability","aliases":["CVE-2026-113808"],"related":[],"title":"SNS enrollment Portal: stored XSS via captive portal user creation","description":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.\n\n\n\nThrough the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.","summary":"The SNS enrollment Portal has a stored cross-site scripting flaw reachable through its captive portal when a user is created. The injected script runs in the browser of an administrator who validates the request, so an attacker can act with admin rights.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["captive-portal","other","sns-enrollment-portal"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T19:17:34+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:34:36+00:00","updated_at":"2026-10-25T03:34:36+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T03:34:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"SNS enrollment Portal: stored XSS via captive portal user creation","impact":"medium","summary":"The SNS enrollment Portal has a stored cross-site scripting flaw reachable through its captive portal when a user is created. The injected script runs in the browser of an administrator who validates the request, so an attacker can act with admin rights.","category":"other","nicknames":[],"who_cares":["sns-enrollment-portal","captive-portal"],"confidence":0.4,"needs_auth":"no","worst_case":"Injected script runs in an administrator's browser session","analyst_note":"Find the vendor and affected versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113808; confirm whether a patch exists and how to verify exposure.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources do not name the affected product versions or confirm which deployments expose the captive portal to outside users.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00053,"input_tokens":3294,"output_tokens":401,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113808':13A,16A '-2026':12A,15A 'act':65B 'admin':67B 'administr':56B,107C 'attack':63B,87C 'browser':53B 'captiv':7A,18B,40B,84C 'captive-port':17B 'creat':46B 'creation':10A,95C 'cross':33B,72C 'cross-sit':32B,71C 'cve':11A,14A 'enrol':2A,23B,27B,80C 'exist':76C 'flaw':36B 'inject':48B,89C 'portal':3A,8A,19B,24B,28B,41B,81C,85C 'reachabl':37B 'request':60B,93C 'right':68B 'run':50B 'script':35B,49B,74C 'site':34B,73C 'sns':1A,22B,26B,79C 'sns-enrollment-port':21B 'store':4A,31B,70C,97C 'trigger':102C 'user':9A,44B,94C 'valid':58B,104C 'via':6A 'vulner':75C 'xss':5A,91C,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T19:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cert@airbus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113808","severity":null,"published_at":"2026-10-20T19:17:34+00:00","modified_at":"2026-10-20T19:35:23+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}