CVE-2026-22674 is a stored cross-site scripting vulnerability in Hashgraph Guardian through version 3.6.0. It allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. The vulnerability stems from unsanitized innerHTML assignment in the branding service, enabling arbitrary JavaScript execution in the browsers of authenticated users on every page load. The flaw was addressed in a code commit identified as ba8c566.

Successful exploitation allows an authenticated user with the STANDARD_REGISTRY role to execute arbitrary JavaScript in the browsers of other authenticated users. This can lead to session hijacking, unauthorized actions, or data theft within the context of the affected application. The CVSS 4.8 (medium) score reflects the need for authentication and user interaction, and the limited scope to authenticated users.

A fix is available and was implemented in commit ba8c566. Users should upgrade to a version of Hashgraph Guardian that includes this commit or later. Since the vulnerability requires authenticated access with a specific role, limiting user privileges and monitoring for suspicious activity may help reduce risk until the patch is applied.