CVE-2026-66092: Stored XSS in pre-login notice via reachable legacy logon route
In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDITSYSTEMSETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDITSYSTEMSETTINGS has been granted to the guest user or Everyone
Affected Software
Event History
Frequently Asked Questions
Who can exploit this without logging in?
Unauthenticated exploitation is possible only where the guest user or Everyone has been granted the EDIT_SYSTEM_SETTINGS permission. Otherwise, an attacker needs an account with that permission to set the pre-login notice.
Which deployments are affected?
openEQUELLA versions before 2026.2 are affected when the legacy logon route renders a pre-login notice containing unsanitised HTML. Deployments that do not grant EDIT_SYSTEM_SETTINGS to unauthenticated principals still risk exploitation by privileged users or compromised privileged accounts.
What can be done before upgrading?
Remove EDIT_SYSTEM_SETTINGS from the guest user and Everyone, and restrict it to trusted administrative accounts. Review the configured pre-login notice and remove any untrusted or script-containing HTML.