CVE-2026-59076 · Other
NO FIX YET · SEE WHAT TO DO
An authenticated user can save a script in the givenName or surname profile fields through the /api/auth/profile endpoint. When an administrator opens the admin changelog logs, that script runs in the administrator's browser.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Edito CMS where users can edit their own profile names and administrators open the admin changelog logs. The attacker needs an authenticated account, so instances with closed registration and trusted users carry less risk. Sources do not state a default configuration that enables this.
Not affected if auth-required, fixed-version
Who cares edito-cms, self-hosted
5.10.2607 (or the 5.8 hotfix)5.10.2607 (source states this version fixes the issue)Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.