CVE-2026-117493: Multiple vulnerabilities in Sisense’s Cloud BI Platform
Published Oct 27, 2026
·Updated
Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
Affected Software
1 affected component
Sisense Cloud BI Platform
Event History
Oct 27, 2026
CVE Published
via MITRE·09:15 AM
Data Sourced
via MITRE·09:15 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs the ability to submit HTML or JavaScript through the dashboard widget API’s desc or text parameters. The supplied code executes when the affected BloX widget is rendered in a browser.
2
Who is exposed when a malicious widget is rendered?
Users who render the affected widget in their browser are exposed. The impact is limited to the confidentiality of information accessible in that browser context.