A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary… (CVE-2026-76154)
CVE-2026-76154 is a stored cross-site scripting (XSS) vulnerability in the Geomap panel's MapLibre base layer. It allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration. This can lead to escalation of privileges to Org Admin. The vulnerability has a CVSS score of 7.3, indicating high severity.
AI Analysis
Technical Summary
This vulnerability involves stored XSS in the MapLibre base layer of the Geomap panel. An attacker with Editor privileges can inject malicious JavaScript by hosting a crafted style configuration. When another user loads the affected panel, the script executes in their session context, potentially allowing the attacker to escalate privileges to Org Admin. The vulnerability is rated with a CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). No patch or remediation details are provided in the input data.
Potential Impact
Successful exploitation allows an attacker with Editor role to execute arbitrary JavaScript in other users' sessions, leading to potential privilege escalation to Org Admin. This compromises confidentiality and integrity of user sessions but does not impact availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data.
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary… (CVE-2026-76154)
Description
CVE-2026-76154 is a stored cross-site scripting (XSS) vulnerability in the Geomap panel's MapLibre base layer. It allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration. This can lead to escalation of privileges to Org Admin. The vulnerability has a CVSS score of 7.3, indicating high severity.
CVSS v3.1
Score 7.3high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves stored XSS in the MapLibre base layer of the Geomap panel. An attacker with Editor privileges can inject malicious JavaScript by hosting a crafted style configuration. When another user loads the affected panel, the script executes in their session context, potentially allowing the attacker to escalate privileges to Org Admin. The vulnerability is rated with a CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N). No patch or remediation details are provided in the input data.
Potential Impact
Successful exploitation allows an attacker with Editor role to execute arbitrary JavaScript in other users' sessions, leading to potential privilege escalation to Org Admin. This compromises confidentiality and integrity of user sessions but does not impact availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-35gc-393c-vjxf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76154"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aac8ddf55bf5e2cf548ff53
Added to database: 09/18/2026, 01:03:27 UTC
Last enriched: 09/18/2026, 01:24:24 UTC
Last updated: 09/18/2026, 03:01:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.