CVE-2026-47106: Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with Banner ERP write access can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle; these values are subsequently served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution in the browser of any user who views the affected course's meeting times.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ellucian Banner Self-Serviceto a version that resolves this vulnerability.Fixed in before the April T2 release (2025-04-23) - Configuration
Ensure faculty/course fields returned by the unauthenticated getFacultyMeetingTimes API endpoint (e.g., faculty displayName, emailAddress, subjectDescription, courseTitle) are properly HTML-encoded/sanitized before being inserted into the DOM to prevent stored XSS execution.
getFacultyMeetingTimes API (unauthenticated) HTML encoding / output sanitization = sanitized (encode HTML) instead of serving unsanitized field values
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47106?
The severity of CVE-2026-47106 is medium with a score of 5.1.
What type of vulnerability is CVE-2026-47106?
CVE-2026-47106 is a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-47106?
To fix CVE-2026-47106, update to the Ellucian Banner Self-Service version released after April 23, 2025.
Who is affected by CVE-2026-47106?
Authenticated Banner ERP users of Ellucian Banner Self-Service are affected by CVE-2026-47106.
What impact does CVE-2026-47106 have?
CVE-2026-47106 allows attackers to inject malicious payloads into faculty and course fields.