{"id":"CVE-2026-66092","kind":"vulnerability","aliases":["CVE-2026-66092"],"related":[],"title":"openEQUELLA: pre-login notice lets script run on the login page","description":"In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone","summary":"openEQUELLA renders the pre-login notice as raw HTML on the legacy logon page without encoding or sanitisation. A user with the EDIT_SYSTEM_SETTINGS permission can store a script in the notice, which runs in the browser of anyone who loads the login page.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","lms","openequella","other","self-hosted"],"not_affected_if":["no-edit-system-settings-for-guest-or-everyone","patched-2026.2-or-later"],"how_to_check":"- Check the openEQUELLA version in the deployment; affected versions are before `2026.2`.\n- Check whether the guest user or the Everyone group holds EDIT_SYSTEM_SETTINGS, since that allows unauthenticated exploitation.\n- Review the current pre-login notice content via the admin settings for embedded script tags or event handlers.","fix":"- Upgrade openEQUELLA to `2026.2` or later.\n- Remove EDIT_SYSTEM_SETTINGS from the guest user and the Everyone group.\n- Rotate credentials for any administrator accounts if a suspicious notice was found.","status":"open","published_at":"2026-10-29T02:16:53+00:00","first_seen_at":"2026-10-29T02:36:48+00:00","triaged_at":"2026-10-29T02:38:05+00:00","updated_at":"2026-10-29T02:38:05+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-29T02:38:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade openEQUELLA to `2026.2` or later.\n- Remove EDIT_SYSTEM_SETTINGS from the guest user and the Everyone group.\n- Rotate credentials for any administrator accounts if a suspicious notice was found.","reach":"internet","title":"openEQUELLA: pre-login notice lets script run on the login page","impact":"medium","summary":"openEQUELLA renders the pre-login notice as raw HTML on the legacy logon page without encoding or sanitisation. A user with the EDIT_SYSTEM_SETTINGS permission can store a script in the notice, which runs in the browser of anyone who loads the login page.","category":"other","nicknames":[],"who_cares":["openequella","self-hosted","lms","java"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in visitors' browsers on the login page, stealing session data","analyst_note":"","how_to_check":"- Check the openEQUELLA version in the deployment; affected versions are before `2026.2`.\n- Check whether the guest user or the Everyone group holds EDIT_SYSTEM_SETTINGS, since that allows unauthenticated exploitation.\n- Review the current pre-login notice content via the admin settings for embedded script tags or event handlers.","needs_analyst":false,"not_affected_if":["patched-2026.2-or-later","no-edit-system-settings-for-guest-or-everyone"],"who_is_affected":"Deployments of openEQUELLA before 2026.2 are affected, and the risk rises where EDIT_SYSTEM_SETTINGS is granted to the guest user or Everyone, because the injected script can then be planted without a logged-in account. Installations where only trusted administrators hold that permission and the guest and Everyone roles lack it carry lower risk. Teams not running openEQUELLA can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":3393,"output_tokens":685,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-66092':15A,18A '/api/preloginnotice':113C '2026.2':75C 'anyon':66B 'arbitrari':110C 'browser':64B 'contain':108C 'cross':118C 'cross-sit':117C 'cve':13A,16A 'edit':49B,100C,130C 'encod':42B,93C 'everyon':141C 'exploit':126C 'grant':135C 'guest':138C 'hold':98C 'host':25B 'html':35B,84C 'java':19B 'legaci':38B,89C 'let':6A 'lms':20B 'load':68B 'login':4A,11A,31B,70B,79C,123C 'logon':39B,90C 'notic':5A,32B,59B,80C,107C 'openequella':1A,21B,26B,73C 'page':12A,40B,71B,91C,124C 'permiss':52B,103C 'possibl':128C 'pre':3A,30B,78C 'pre-login':2A,29B,77C 'put':112C 'raw':34B 'render':27B,86C 'result':114C 'run':8A,61B 'sanitis':44B,95C 'script':7A,56B,111C,120C 'self':24B 'self-host':23B 'set':51B,102C,105C,132C 'site':119C 'store':54B,82C,116C 'system':50B,101C,131C 'unauthent':125C 'user':46B,97C,139C 'without':41B,92C","nicknames":[],"mitigations":[],"who_affected":"Deployments of openEQUELLA before 2026.2 are affected, and the risk rises where EDIT_SYSTEM_SETTINGS is granted to the guest user or Everyone, because the injected script can then be planted without a logged-in account. Installations where only trusted administrators hold that permission and the guest and Everyone roles lack it carry lower risk. Teams not running openEQUELLA can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T02:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66092","severity":null,"published_at":"2026-10-29T02:16:53+00:00","modified_at":"2026-10-29T02:16:53+00:00","first_seen_at":"2026-10-29T02:36:48+00:00","fetched_at":"2026-10-29T02:36:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}