{"id":"CVE-2026-120443","kind":"vulnerability","aliases":["CVE-2026-120443"],"related":[],"title":"GoFound: unauthenticated stored script injection runs in admin browsers","description":"GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.","summary":"GoFound through 1.4.1 lets anyone submit document text to its index API, and that text is later rendered unescaped in the admin dashboard. When an administrator's search matches the stored document, the injected script runs in the admin's browser.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gofound","other","self-hosted"],"not_affected_if":["auth-required","newer-than-1.4.1"],"how_to_check":"- Check the installed GoFound version against the affected range through 1.4.1\n- Confirm whether the `/api/index` endpoint is reachable from untrusted networks","fix":null,"status":"open","published_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:26:18+00:00","updated_at":"2026-11-02T15:26:18+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T15:26:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GoFound: unauthenticated stored script injection runs in admin browsers","impact":"medium","summary":"GoFound through 1.4.1 lets anyone submit document text to its index API, and that text is later rendered unescaped in the admin dashboard. When an administrator's search matches the stored document, the injected script runs in the admin's browser.","audience":"businesses","category":"other","nicknames":[],"who_cares":["gofound","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in admin browser, session and dashboard actions taken","analyst_note":"Confirm fixed version and whether /api/index requires authentication; source is NVD and a VulnCheck advisory.","how_to_check":"- Check the installed GoFound version against the affected range through 1.4.1\n- Confirm whether the `/api/index` endpoint is reachable from untrusted networks\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","newer-than-1.4.1"],"who_is_affected":"Teams running GoFound at or below 1.4.1 where the indexing endpoint accepts documents from people outside the admin group. The admin dashboard's search results are where the script runs, so exposure depends on whether administrators search over content that untrusted users can submit. unknown whether a patched release exists.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4174,"output_tokens":524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120443':12A,15A '-2026':11A,14A '/api/index':85C '1.4.1':23B,64C 'admin':8A,42B,59B,111C 'administr':46B,106C 'allow':74C 'anyon':25B 'api':32B 'attack':76C,86C 'browser':9A,61B,108C 'contain':65C 'cross':69C 'cross-sit':68C 'cve':10A,13A 'dashboard':43B 'dashboard.vue':96C 'document':27B,52B,82C,115C 'execut':102C 'gofound':1A,16B,21B,62C 'host':20B 'html':90C,101C 'index':31B,88C 'inject':5A,54B,78C 'later':37B 'let':24B 'malici':89C 'match':49B,113C 'render':38B,97C 'return':93C 'run':6A,56B 'script':4A,55B,71C,79C,103C 'search':48B,112C 'searcher/engine.go':92C 'self':19B 'self-host':18B 'site':70C 'store':3A,51B,67C 'submit':26B,81C 'text':28B,35B,83C 'unauthent':2A,75C 'unescap':39B,94C 'v':100C 'v-html':99C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Teams running GoFound at or below 1.4.1 where the indexing endpoint accepts documents from people outside the admin group. The admin dashboard's search results are where the script runs, so exposure depends on whether administrators search over content that untrusted users can submit. unknown whether a patched release exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gofound","medium","other","selfhosted"],"first_public_at":"2026-11-02T15:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120443","severity":null,"published_at":"2026-11-02T15:17:26+00:00","modified_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52477,"url":"https://www.vulncheck.com/advisories/gofound-through-1.4.1-stored-xss-via-admin-dashboard-search-results","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}