Live › vulnerability › CVE-2026-44977
Go to dashboardCountly server's star-rating plugin lets a non-global application admin upload a file that is later served with an attacker-chosen Content-Type. When a global admin opens the preview, the payload runs in the Countly origin and can read auth_token and csrf_token values.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
24.05.50 and 25.03.44)24.05.50 or 25.03.44 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.
This page as .md · .json · in your agent: get_signal("CVE-2026-44977")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.