---
id: "CVE-2026-120443"
kind: "vulnerability"
aliases: ["CVE-2026-120443"]
title: "GoFound: unauthenticated stored script injection runs in admin browsers"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gofound", "other", "self-hosted"]
not_affected_if: ["auth-required", "newer-than-1.4.1"]
published_at: "2026-11-02T15:17:26+00:00"
first_seen_at: "2026-11-02T15:24:02+00:00"
updated_at: "2026-11-02T15:26:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120443", "first_seen_at": "2026-11-02T15:24:02+00:00"}]
---

# GoFound: unauthenticated stored script injection runs in admin browsers

GoFound through 1.4.1 lets anyone submit document text to its index API, and that text is later rendered unescaped in the admin dashboard. When an administrator's search matches the stored document, the injected script runs in the admin's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GoFound version against the affected range through 1.4.1
- Confirm whether the `/api/index` endpoint is reachable from untrusted networks

## Timeline

- 2026-11-02T15:24:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120443

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/gofound-through-1.4.1-stored-xss-via-admin-dashboard-search-results

## From the sources

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_