CVE-2026-12202: Intelliants Subrion CMS Blocks Endpoint cross site scripting
A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Intelliants Subrion CMS - Blocks Endpointfrom your environment.Uninstall or remove the Blocks Endpoint component/module from the installation if it is not needed.
- Configuration
If the Blocks Endpoint is not required, disable the Blocks Endpoint feature in Subrion CMS to remove the vulnerable surface that accepts CSS class name arguments.
Intelliants Subrion CMS - Blocks Endpoint enabled = false - Compensating control
Apply network or web controls to block or restrict access to the Blocks Endpoint (for example, WAF rules, web server access controls, or firewall rules) and/or validate/filter inputs for CSS class name parameters to prevent XSS payloads.
- Operational
Monitor vendor advisories and security resources for an official patch or update from Intelliants for Subrion CMS and plan to apply the vendor-provided fix when it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12202?
The severity of CVE-2026-12202 is classified as low with a score of 2.4.
What component is affected by CVE-2026-12202?
CVE-2026-12202 affects the Blocks Endpoint functionality of Intelliants Subrion CMS up to version 4.0.3.
What type of attack can be executed through CVE-2026-12202?
CVE-2026-12202 allows for a cross site scripting (XSS) attack that can be launched remotely.
How can I mitigate CVE-2026-12202?
Mitigation of CVE-2026-12202 can be accomplished by updating the Intelliants Subrion CMS to a version beyond 4.0.3.
What is the nature of the issue in CVE-2026-12202?
The nature of the issue in CVE-2026-12202 involves manipulation of the argument CSS class name leading to potential code injection.