Apereo Foundation
CVE-2026-66092: In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the
CVE-2026-66092 Oct 29, 2026 Source: Vendor
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-66092
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2 matching , clear filters
CVE-2026-66092
BR2026-0000-037994
unclaimed
Credited as Nguyễn Tuấn Hùng ( University of Information Technology: VNUHCM - UIT )
CVE-2026-66092
BR2026-0000-037995
unclaimed
Credited as Lê Ngọc Bảo Minh ( University of Information Technology: VNUHCM - UIT )