CVE-2026-24906

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24906", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T19:35:20.530Z", "datePublished": "2026-04-14T17:23:20.461Z", "dateUpdated": "2026-04-16T13:46:05.447Z"}, "containers": {"cna": {"title": "October CMS has Stored XSS in its Backend Editor Markup Classes", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/octobercms/october/security/advisories/GHSA-6qmh-j78v-ffp7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-6qmh-j78v-ffp7"}], "affected": [{"vendor": "octobercms", "product": "october", "versions": [{"version": "< 3.7.14", "status": "affected"}, {"version": ">= 4.0.0, < 4.1.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T17:23:20.461Z"}, "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Exploitation could lead to privilege escalation if a superuser opens any RichEditor during routine content editing (e.g., editing a blog post), and requires authenticated backend access with editor settings permissions. This issue has been fixed in versions 3.7.14 and 4.1.10. To workaround this issue, restrict editor settings permissions to fully trusted administrators only"}], "source": {"advisory": "GHSA-6qmh-j78v-ffp7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:45:53.227273Z", "id": "CVE-2026-24906", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:46:05.447Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24906", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T13:45:53.227273Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:46:01.037Z"}}], "cna": {"title": "October CMS has Stored XSS in its Backend Editor Markup Classes", "source": {"advisory": "GHSA-6qmh-j78v-ffp7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": "< 3.7.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.10"}]}], "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-6qmh-j78v-ffp7", "name": "https://github.com/octobercms/october/security/advisories/GHSA-6qmh-j78v-ffp7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Exploitation could lead to privilege escalation if a superuser opens any RichEditor during routine content editing (e.g., editing a blog post), and requires authenticated backend access with editor settings permissions. This issue has been fixed in versions 3.7.14 and 4.1.10. To workaround this issue, restrict editor settings permissions to fully trusted administrators only"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T17:23:20.461Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24906", "state": "PUBLISHED", "dateUpdated": "2026-04-16T13:46:05.447Z", "dateReserved": "2026-01-27T19:35:20.530Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T17:23:20.461Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "october", "vendor": "octobercms", "versions": [{"status": "affected", "version": "< 3.7.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "matchCriteriaId": "A07FA7C9-BC27-4953-93C7-AB142B989CC2", "versionEndIncluding": "3.7.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C5346C3-F4C0-4DD0-AAAC-A12A7EB93C8F", "versionEndIncluding": "4.1.9", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Exploitation could lead to privilege escalation if a superuser opens any RichEditor during routine content editing (e.g., editing a blog post), and requires authenticated backend access with editor settings permissions. This issue has been fixed in versions 3.7.14 and 4.1.10. To workaround this issue, restrict editor settings permissions to fully trusted administrators only"}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Las versiones anteriores a la 3.7.14 y 4.1.10 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la configuraci\u00f3n del editor de backend. Los campos de Clases de Marcado (utilizados para estilos de p\u00e1rrafo, estilos en l\u00ednea, estilos de tabla, etc.) no sanitizaban la entrada a caracteres v\u00e1lidos de nombres de clases CSS. Valores maliciosos se renderizaban sin sanitizar en los men\u00fas desplegables del editor Froala, permitiendo la ejecuci\u00f3n de JavaScript cuando cualquier usuario abr\u00eda un RichEditor. La explotaci\u00f3n podr\u00eda conducir a una escalada de privilegios si un superusuario abre cualquier RichEditor durante la edici\u00f3n rutinaria de contenido (por ejemplo, editando una entrada de blog), y requiere acceso autenticado al backend con permisos de configuraci\u00f3n del editor. Este problema ha sido solucionado en las versiones 3.7.14 y 4.1.10. Para solucionar este problema, restrinja los permisos de configuraci\u00f3n del editor solo a administradores de plena confianza."}], "id": "CVE-2026-24906", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24906", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:45:53.227273Z", "version": "2.0.3"}}]}, "published": "2026-04-14T18:16:45.063", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-6qmh-j78v-ffp7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.1.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "october", "source": "cna", "vendor": "octobercms"}, "product": "october", "vendor": "octobercms"}], "analysis": {"en": {"generated_at": "2026-04-14T20:34:01.243027+00:00", "value": {"mitigation_remediation": ["Upgrade October CMS to version 3.7.14 or 4.1.10 or later", "If upgrading is not immediately possible, restrict editor settings permissions to fully trusted administrators only as a temporary measure", "Verify that no existing content contains malicious CSS class values in the editor", "Monitor logs for attempts to inject unexpected markup classes and review editor usage after applying the fix"], "summary": {"action": "Patch immediately", "impact": "Stored XSS that can execute JavaScript when a privileged user opens a RichEditor"}, "threat_synthesis": {"affected_systems": "The flaw impacts October CMS products from the October vendor, specifically all releases older than 3.7.14 and 4.1.10. Any deployment of these versions that allows editing of content via the Backend Editor is susceptible unless the editor settings permissions have already been restricted to trusted administrators.", "description_and_impact": "October CMS versions before 3.7.14 and 4.1.10 embed unsanitized input from the Markup Classes fields into the Froala editor dropdowns. The vulnerability allows a user to place malicious JavaScript payloads in CSS class attributes. When a user with editor setting permissions opens a RichEditor, the script runs in the victim\u2019s browser, potentially leading to higher privilege use or session hijacking. The weakness is a stored cross\u2011site scripting flaw.", "risk_and_exploitability": "The CVSS base score is 5.1, indicating moderate severity. Exploitation requires authenticated backend access with editor settings permissions, so the likelihood is limited to users granted those rights. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is therefore constrained to legitimate administrators; however, the impact could allow privilege escalation if a superuser triggers the vulnerable editor. The known fix exists in the stated versions, and in its absence a corrective workaround can be applied by limiting editor settings permissions."}}}}, "created": "2026-04-15T14:31:56.909416+00:00", "updated": "2026-04-15T14:41:09.781126+00:00", "vendors": ["octobercms", "octobercms$PRODUCT$october"]}