CVE-2026-22674 is a stored cross-site scripting vulnerability in Hashgraph Guardian through version 3.6.0. Authenticated users with the STANDARD_REGISTRY role can exploit this by submitting a crafted companyName value via the branding configuration API endpoint. The vulnerability is caused by unsanitized innerHTML assignment in the branding service, which allows injected scripts to execute in the browser context of every authenticated user on every page load. The vulnerability is fixed in a commit identified as ba8c566. No official remediation level or patch link is provided in the data. The CVSS 4.8 score reflects a medium severity with network attack vector, low attack complexity, and required privileges and user interaction.

An attacker with authenticated access and the STANDARD_REGISTRY role can inject malicious scripts that execute in the browsers of other authenticated users. This can lead to unauthorized actions performed in the context of the victim user, potentially compromising user sessions or data accessible to the user. The vulnerability affects all authenticated users who load pages that render the malicious branding configuration. There is no indication of exploitation in the wild at this time.

The vulnerability is fixed in a commit identified as ba8c566. Users should upgrade to a version that includes this fix. Since no official patch or vendor advisory is provided, confirm patch availability by consulting the vendor or the project's repository for the commit ba8c566. Until patched, restrict STANDARD_REGISTRY role assignments to trusted users only and monitor for suspicious activity related to branding configuration changes.