{"id":"CVE-2026-7004","kind":"vulnerability","aliases":["CVE-2026-7004"],"related":[],"title":"WIT SynApps Runtime: unauthenticated reflected XSS via LINK parameter","description":"WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.","summary":"WIT SynApps Runtime through 1.4.11 reflects the LINK query parameter sent to /System/Session-1 without escaping, so a crafted link runs attacker JavaScript in the victim's browser without logging in. An attacker can use that to harvest credentials, alter the login flow, read browser-visible data and make same-origin requests to controller endpoints.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","synapps","web-ui","wit-synapps"],"not_affected_if":["version-above-1.4.11"],"how_to_check":"- Look for the SynApps Runtime version in the deployed app; the sources say versions through `1.4.11` are affected.\n- Check whether `/System/Session-1` is reachable from the internet or from untrusted networks.","fix":"- Move past `1.4.11`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T19:19:13+00:00","first_seen_at":"2026-10-30T19:25:31+00:00","triaged_at":"2026-10-30T19:26:28+00:00","updated_at":"2026-10-30T19:26:28+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T19:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move past `1.4.11`; the sources do not name the fixed version.","reach":"internet","title":"WIT SynApps Runtime: unauthenticated reflected XSS via LINK parameter","impact":"medium","summary":"WIT SynApps Runtime through 1.4.11 reflects the LINK query parameter sent to /System/Session-1 without escaping, so a crafted link runs attacker JavaScript in the victim's browser without logging in. An attacker can use that to harvest credentials, alter the login flow, read browser-visible data and make same-origin requests to controller endpoints.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["synapps","wit-synapps","web-ui"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker JavaScript runs in user sessions, harvesting credentials","analyst_note":"Find the fixed SynApps Runtime version and vendor advisory; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-7004 does not state a fix.","how_to_check":"- Look for the SynApps Runtime version in the deployed app; the sources say versions through `1.4.11` are affected.\n- Check whether `/System/Session-1` is reachable from the internet or from untrusted networks.\n- unknown for any other check, the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-above-1.4.11"],"who_is_affected":"Teams running WIT SynApps Runtime version 1.4.11 or earlier that expose the /System/Session-1 endpoint to users or the internet are exposed. The sources note an origin-switch effect against the internal controller in Cloud RIA setups. Deployments not running this version, or not exposing that endpoint, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4217,"output_tokens":673,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-7004':12A,15A '/system/session-1':36B,115C '1.4.11':28B,84C 'access':129C 'allow':97C 'alter':62B 'arbitrari':104C 'attack':44B,55B,99C,117C 'authent':89C 'browser':50B,68B,131C 'browser-vis':67B,130C 'cloud':154C 'contain':85C 'control':78B,141C,152C 'craft':41B,109C 'credenti':61B,124C 'cross':92C 'cross-sit':91C 'cve':10A,13A 'data':70B,133C 'endpoint':79B,116C,142C 'escap':38B 'execut':103C 'exploit':119C 'flaw':121C 'flow':65B,128C 'harvest':60B,123C 'includ':143C 'inject':101C 'intern':151C 'javascript':45B,105C 'link':8A,31B,42B,110C 'log':52B 'login':64B,127C 'make':72B 'manipul':125C 'origin':75B,138C,146C 'origin-switch':145C 'paramet':9A,33B,112C 'perform':135C 'pre':88C 'pre-authent':87C 'primit':148C 'queri':32B,111C 'read':66B 'reflect':5A,29B,90C 'request':76B,139C 'ria':155C 'run':43B 'runtim':3A,16B,26B,82C 'same-origin':73B,136C 'scenario':156C 'script':94C 'sent':34B 'site':93C 'submit':107C 'switch':147C 'synapp':2A,17B,23B,25B,81C 'ui':20B 'unauthent':4A,98C 'use':57B 'via':7A 'victim':48B 'visibl':69B,132C 'vulner':95C 'web':19B 'web-ui':18B 'wit':1A,22B,24B,80C 'wit-synapp':21B 'without':37B,51B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Teams running WIT SynApps Runtime version 1.4.11 or earlier that expose the /System/Session-1 endpoint to users or the internet are exposed. The sources note an origin-switch effect against the internal controller in Cloud RIA setups. Deployments not running this version, or not exposing that endpoint, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:19:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-7004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7004","severity":null,"published_at":"2026-10-30T19:19:13+00:00","modified_at":"2026-10-30T19:23:25+00:00","first_seen_at":"2026-10-30T19:25:31+00:00","fetched_at":"2026-10-30T19:25:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}