{"id":"CVE-2026-59076","kind":"vulnerability","aliases":["CVE-2026-59076"],"related":[],"title":"Edito CMS: stored script in profile names runs in admin browser","description":"Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.\n\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","summary":"An authenticated user can save a script in the givenName or surname profile fields through the /api/auth/profile endpoint. When an administrator opens the admin changelog logs, that script runs in the administrator's browser.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edito-cms","other","self-hosted"],"not_affected_if":["auth-required","fixed-version"],"how_to_check":"- Check the installed Edito CMS version and compare it with the fixed release `5.10.2607` (or the 5.8 hotfix)\n- Review user profile names for script-like content, if you run Edito CMS","fix":"- Edito CMS `5.10.2607` (source states this version fixes the issue)\n- Hotfixes for older versions such as 5.8 have also been released (versions not specified beyond 5.8)","status":"open","published_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:29+00:00","updated_at":"2026-11-13T08:45:29+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T08:45:29Z","model":"claude-haiku-5-5","output":{"fix":"- Edito CMS `5.10.2607` (source states this version fixes the issue)\n- Hotfixes for older versions such as 5.8 have also been released (versions not specified beyond 5.8)","reach":"network","title":"Edito CMS: stored script in profile names runs in admin browser","impact":"medium","summary":"An authenticated user can save a script in the givenName or surname profile fields through the /api/auth/profile endpoint. When an administrator opens the admin changelog logs, that script runs in the administrator's browser.","audience":"businesses","category":"other","nicknames":[],"who_cares":["edito-cms","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Administrator's browser runs attacker script inside the admin session","analyst_note":"Product name and ecosystem not given in the input; the vendor advisory was not read.","how_to_check":"- Check the installed Edito CMS version and compare it with the fixed release `5.10.2607` (or the 5.8 hotfix)\n- Review user profile names for script-like content, if you run Edito CMS","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","fixed-version"],"who_is_affected":"Teams running Edito CMS where users can edit their own profile names and administrators open the admin changelog logs. The attacker needs an authenticated account, so instances with closed registration and trusted users carry less risk. Sources do not state a default configuration that enables this.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4600,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59076':14A,17A '/api/auth/profile':41B,89C '5.10.2607':114C '5.8':119C 'admin':10A,48B,96C 'administr':45B,56B,93C 'also':121C 'attack':77C 'authent':26B,76C 'automat':103C 'browser':11A,58B,107C 'changelog':49B,97C 'cms':2A,20B,60C 'cross':66C 'cross-sit':65C 'cve':12A,15A 'due':70C 'edito':1A,19B,59C 'edito-cm':18B 'endpoint':42B,90C 'execut':104C 'field':38B 'fix':111C 'givennam':34B,83C 'host':24B 'hotfix':115C 'improp':72C 'inject':79C,100C 'input':73C 'issu':109C 'log':50B,98C 'malici':80C 'name':7A 'older':117C 'open':46B 'paramet':86C 'profil':6A,37B 'releas':123C 'run':8A,53B 'save':29B 'script':4A,31B,52B,68C,81C,101C 'self':23B 'self-host':22B 'site':67C 'store':3A,64C 'surnam':36B,85C 'user':27B 'valid':74C 'version':113C,118C 'via':87C 'visit':94C 'vulner':62C 'xss':69C","nicknames":[],"mitigations":[],"who_affected":"Teams running Edito CMS where users can edit their own profile names and administrators open the admin changelog logs. The attacker needs an authenticated account, so instances with closed registration and trusted users carry less risk. Sources do not state a default configuration that enables this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["editocms","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59076':14A,17A 'admin':10A 'browser':11A 'cms':2A 'cve':12A,15A 'edito':1A 'name':7A 'profil':6A 'run':8A 'script':4A 'store':3A","search_b":"'/api/auth/profile':41B 'admin':48B 'administr':45B,56B 'authent':26B 'browser':58B 'changelog':49B 'cms':20B 'edito':19B 'edito-cm':18B 'endpoint':42B 'field':38B 'givennam':34B 'host':24B 'log':50B 'open':46B 'profil':37B 'run':53B 'save':29B 'script':31B,52B 'self':23B 'self-host':22B 'surnam':36B 'user':27B","search_c":"'/api/auth/profile':89C '5.10.2607':114C '5.8':119C 'admin':96C 'administr':93C 'also':121C 'attack':77C 'authent':76C 'automat':103C 'browser':107C 'changelog':97C 'cms':60C 'cross':66C 'cross-sit':65C 'due':70C 'edito':59C 'endpoint':90C 'execut':104C 'fix':111C 'givennam':83C 'hotfix':115C 'improp':72C 'inject':79C,100C 'input':73C 'issu':109C 'log':98C 'malici':80C 'older':117C 'paramet':86C 'releas':123C 'script':68C,81C,101C 'site':67C 'store':64C 'surnam':85C 'valid':74C 'version':113C,118C 'via':87C 'visit':94C 'vulner':62C 'xss':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59076","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59076","severity":null,"published_at":"2026-11-13T08:17:17+00:00","modified_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}