CVE-2026-111040: Multiple vulnerabilities in Coupa’s Total Spend Management Platform
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the platform who view content containing attacker-controlled editable fields managed by TinyMCE may be exposed to the injected HTML when it is rendered in their browser. Exploitation requires an authenticated attacker with low privileges.
Does exploitation require user interaction?
Yes. The CVSS vector indicates user interaction is required, and the stored HTML affects other users when they view the rendered content.
What is the impact of successful exploitation?
The issue can compromise the confidentiality and integrity of content within the application by altering how stored content is displayed. Availability impact is not indicated.