CVE-2026-41469: Beghelli Sicuro24 SicuroWeb Missing Content Security Policy
Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaScript resources from attacker-controlled origins. When chained with the template injection and sandbox escape vulnerabilities present in the same application, the absence of CSP removes the browser-enforced restriction that would otherwise block external script execution, enabling attackers to load arbitrary remote payloads into operator browser sessions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41469?
CVE-2026-41469 is considered to have a high severity due to the potential for external script execution from untrusted sources.
How do I fix CVE-2026-41469?
To fix CVE-2026-41469, implement a strong Content Security Policy to restrict the loading of external JavaScript resources.
What are the risks associated with CVE-2026-41469?
The risks include potential execution of malicious scripts that can lead to data theft or unauthorized actions on behalf of users.
Can CVE-2026-41469 be exploited easily?
Yes, CVE-2026-41469 can be easily exploited if proper security measures such as a Content Security Policy are not in place.
Which software is affected by CVE-2026-41469?
CVE-2026-41469 specifically affects the Beghelli Sicuro24 SicuroWeb platform.