CVE-2026-23695 is a stored cross-site scripting vulnerability in Cockpit CMS through version 2.14.0. The issue exists in the Set field type's Display template option, where user-controlled template strings are processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization. This allows an attacker with content/:models/manage permission to inject and execute arbitrary JavaScript in the browsers of users viewing the collection items list. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with content/:models/manage permission can inject arbitrary JavaScript code into the Display template, which executes in the context of users viewing the collection items list. This can lead to typical XSS impacts such as session hijacking, unauthorized actions, or information disclosure within the affected application context. The vulnerability requires some level of privilege (content/:models/manage) and user interaction (viewing the collection items list). There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is due to lack of sanitization in the Display template option, administrators should restrict permissions to trusted users only and avoid granting content/:models/manage permission broadly. Monitor vendor channels for an official fix or update. Until a patch is available, consider disabling or limiting use of the Set field type's Display template feature if feasible.