CVE-2026-27787

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27787", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-04-03T04:29:15.069Z", "datePublished": "2026-04-08T05:11:11.154Z", "dateUpdated": "2026-04-08T13:55:07.158Z"}, "containers": {"cna": {"affected": [{"vendor": "ICZ Corporation", "product": "MATCHA SNS", "versions": [{"version": "1.3.9 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting (XSS)", "lang": "en-US", "cweId": "CWE-79", "type": "CWE"}]}], "references": [{"url": "https://oss.icz.co.jp/news/?p=1388"}, {"url": "https://jvn.jp/en/jp/JVN33581068/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-04-08T05:11:11.154Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T13:55:00.130119Z", "id": "CVE-2026-27787", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T13:55:07.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27787", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T13:55:00.130119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T13:55:03.362Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "ICZ Corporation", "product": "MATCHA SNS", "versions": [{"status": "affected", "version": "1.3.9 and earlier"}]}], "references": [{"url": "https://oss.icz.co.jp/news/?p=1388"}, {"url": "https://jvn.jp/en/jp/JVN33581068/"}], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-79", "description": "Cross-site scripting (XSS)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-04-08T05:11:11.154Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27787", "state": "PUBLISHED", "dateUpdated": "2026-04-08T13:55:07.158Z", "dateReserved": "2026-04-03T04:29:15.069Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-04-08T05:11:11.154Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MATCHA SNS", "vendor": "ICZ Corporation", "versions": [{"status": "affected", "version": "1.3.9 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:icz:matcha_sns:*:*:*:*:*:*:*:*", "matchCriteriaId": "3644E0FD-FAB6-4D37-B37A-FA17DBB9B755", "versionEndIncluding": "1.3.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product."}, {"lang": "es", "value": "Vulnerabilidad de cross-site scripting existe en MATCHA SNS 1.3.9 y anteriores. Si esta vulnerabilidad es explotada, un script arbitrario puede ser ejecutado en el navegador web del usuario que accedi\u00f3 al sitio web utilizando el producto."}], "id": "CVE-2026-27787", "lastModified": "2026-07-25T10:10:00.167", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27787", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T13:55:00.130119Z", "version": "2.0.3"}}]}, "published": "2026-04-08T06:16:28.480", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN33581068/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://oss.icz.co.jp/news/?p=1388"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.9]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 96.0, "source": "matching"}]}, "original": {"product": "MATCHA SNS", "source": "cna", "vendor": "ICZ Corporation"}, "product": "matchasns", "vendor": "icz"}], "analysis": {"en": {"generated_at": "2026-04-08T06:20:22.194443+00:00", "value": {"mitigation_remediation": ["Upgrade MATCHA SNS to a patched version released by ICZ Corporation", "If an update is not immediately available, implement output encoding and input validation for all user\u2011supplied data to prevent script injection", "Verify that the site does not render unsanitized input in any HTML, JavaScript, or CSS contexts", "Monitor web application logs for suspicious inputs that could indicate attempted exploitation"], "summary": {"action": "Apply Patch", "impact": "Remote execution of arbitrary scripts via browser"}, "threat_synthesis": {"affected_systems": "ICZ Corporation\u2019s MATCHA SNS version 1.3.9 and all earlier releases are affected. Users running these or earlier builds are exposed to the threat", "description_and_impact": "This vulnerability is a classic cross\u2011site scripting flaw that permits an attacker to inject arbitrary scripts into the web page delivered to a visitor of the MATCHA SNS site. If an attacker successfully supplies malicious input that is not properly escaped, that script will execute in the victim\u2019s browser with the privileges of the page, potentially compromising sensitive data or performing actions on behalf of the user.", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate severity; the EPSS value is not available and the vulnerability has not been listed in CISA\u2019s KEV catalog, suggesting no known wide\u2011scale exploitation to date. The likely attack vector involves an attacker posting or submitting malicious input that the site reflects without sanitization, which can be exploited by any user who visits the vulnerable page. While no known exploits are publicly documented, the presence of a browser\u2011based code execution path presents a significant confidentiality and integrity risk if the site is frequently visited by authenticated users or administrators."}}}}, "created": "2026-04-08T19:43:54.214628+00:00", "title": "Cross\u2011Site Scripting Vulnerability in MATCHA SNS Allowing Arbitrary Script Execution", "updated": "2026-04-09T08:22:22.875841+00:00", "vendors": ["icz", "icz$PRODUCT$matchasns"]}