{"id":"CVE-2026-44977","kind":"vulnerability","aliases":["CVE-2026-44977"],"related":[],"title":"countly-server is the server-side part of Countly, a product analytics solution","description":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.","summary":"Countly server's star-rating plugin lets a non-global application admin upload a file that is later served with an attacker-chosen Content-Type. When a global admin opens the preview, the payload runs in the Countly origin and can read auth_token and csrf_token values.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["countly","package","product-analytics","self-hosted"],"not_affected_if":["fixed-version","star-rating-plugin-disabled"],"how_to_check":"Check the installed countly-server version (fixed in 24.05.50 and 25.03.44). Check whether the star-rating plugin is enabled and whether feedback/preview/ serves uploaded files.","fix":"Upgrade countly-server to 24.05.50 or 25.03.44 or later.\nUntil then, disable the star-rating plugin or restrict who can open feedback previews.","status":"open","published_at":"2026-10-16T16:17:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:15:11+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:15:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade countly-server to 24.05.50 or 25.03.44 or later.\nUntil then, disable the star-rating plugin or restrict who can open feedback previews.","reach":"internet","impact":"high","summary":"Countly server's star-rating plugin lets a non-global application admin upload a file that is later served with an attacker-chosen Content-Type. When a global admin opens the preview, the payload runs in the Countly origin and can read auth_token and csrf_token values.","category":"package","who_cares":["countly","self-hosted","product-analytics"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs script as global admin, stealing session tokens and acting for them.","analyst_note":"","how_to_check":"Check the installed countly-server version (fixed in 24.05.50 and 25.03.44). Check whether the star-rating plugin is enabled and whether feedback/preview/ serves uploaded files.","needs_analyst":false,"not_affected_if":["fixed-version","star-rating-plugin-disabled"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00049,"input_tokens":2890,"output_tokens":401,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-44977':18A,21A '24.05.50':99C,175C '25.03.44':101C,177C 'activ':118C 'admin':43B,62B 'administr':109C,145C 'allow':103C 'analyt':14A,26B,95C 'applic':42B,108C 'attack':54B,116C,137C 'attacker-chosen':53B 'attacker-control':115C 'attacker-influenc':136C 'auth':76B,163C 'authent':159C 'capabl':161C 'chosen':55B 'content':57B,119C,131C,140C 'content-typ':56B,139C 'control':117C 'count':2A,11A,22B,30B,71B,83C,92C,155C 'countly-serv':1A,82C 'csrf':79B,166C 'cve':16A,19A 'execut':150C 'expos':158C 'feedback/preview':133C 'file':46B 'fix':172C 'global':41B,61B,107C,144C 'host':29B 'includ':162C 'influenc':138C 'issu':170C 'later':49B 'let':37B 'mime':124C 'non':40B,106C 'non-glob':39B,105C 'open':63B,147C 'origin':72B,156C 'packag':23B 'part':9A,90C 'payload':67B,152C 'plugin':36B 'plugins/star-rating/api/api.js':102C 'plugins/star-rating/frontend/app.js':126C 'preview':65B,149C 'prior':97C 'product':13A,25B,94C 'product-analyt':24B 'public':127C 'rate':35B 'read':75B 'run':68B 'self':28B 'self-host':27B 'serv':50B,128C 'server':3A,7A,31B,84C,88C 'server-sid':6A,87C 'session':160C 'side':8A,89C 'solut':15A,96C 'star':34B 'star-rat':33B 'store':114C,130C 'suppli':123C 'token':77B,80B,164C,167C 'trust':121C 'type':58B,125C,141C 'upload':44B 'uploadfeedbackfil':112C 'use':111C 'valu':81B,168C 'version':174C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-44977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44977","severity":null,"published_at":"2026-10-16T16:17:44+00:00","modified_at":"2026-10-21T03:17:19+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}