Live › vulnerability › CVE-2026-66092
Go to dashboardopenEQUELLA renders the pre-login notice as raw HTML on the legacy logon page without encoding or sanitisation. A user with the EDIT_SYSTEM_SETTINGS permission can store a script in the notice, which runs in the browser of anyone who loads the login page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Deployments of openEQUELLA before 2026.2 are affected, and the risk rises where EDIT_SYSTEM_SETTINGS is granted to the guest user or Everyone, because the injected script can then be planted without a logged-in account. Installations where only trusted administrators hold that permission and the guest and Everyone roles lack it carry lower risk. Teams not running openEQUELLA can skip it.
No product ranges from the sources yet.
2026.2.2026.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone
This page as .md · .json · in your agent: get_signal("CVE-2026-66092")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.