CVE-2026-71802: XSS
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html().text() method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires the ability to control announcement content. This could be an administrator or another attacker with permission to create or modify announcements.
Which users may be exposed to injected JavaScript?
Users are exposed when they view a page where the malicious announcement is visible. Depending on the announcement visibility settings, this may include the dashboard, activity feed, or login page.
Does server-side HTML escaping prevent exploitation?
No. Although announcement content is escaped on the server, the client-side preview code reverses escaped entities and injects the resulting content into the DOM.