CVE-2026-111037: Multiple vulnerabilities in Coupa’s Total Spend Management Platform
A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim’s browser. A successful exploit could allow the attacker to perform actions on the victim’s behalf, disclose accessible information or manipulate the user interface.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Users of the Tenders module in the Coupa Supplier Portal SaaS platform are exposed if they open an attacker-crafted URL. The attacker must have a low-privileged account to create the malicious link.
What does successful exploitation require?
Exploitation requires user interaction: a victim must open the malicious URL. The vulnerable list_item_function parameter is then reflected into a JavaScript event-handler context, allowing attacker-supplied script to run in the victim's browser.
What could an attacker do after exploiting it?
Scripts execute in the victim's browser context and may let the attacker perform actions on the victim's behalf, disclose information the victim can access, or manipulate the user interface.