CVE-2026-24906 is a stored XSS vulnerability in OctoberCMS's Backend Editor Settings affecting versions before 3.7.14 and between 4.0.0 and 4.1.10. The Markup Classes fields, which define paragraph, inline, and table styles, do not sanitize input to valid CSS class name characters. This allows malicious input to be rendered unsanitized in Froala editor dropdown menus, enabling JavaScript execution when any user opens a RichEditor. Exploitation requires authenticated backend access with editor settings permissions and can lead to privilege escalation if a superuser opens the editor during content editing. The vulnerability is fixed in versions 3.7.14 and 4.1.10.

Successful exploitation allows an attacker with editor settings permissions to execute arbitrary JavaScript in the context of the backend interface, potentially leading to privilege escalation if a superuser opens the RichEditor. This could compromise the integrity of the CMS backend and allow unauthorized actions. The vulnerability requires authenticated access and specific permissions, limiting the attack surface.

This vulnerability is fixed in OctoberCMS versions 3.7.14 and 4.1.10. Users should upgrade to these or later versions to remediate the issue. Until patched, restrict editor settings permissions strictly to fully trusted administrators to reduce the risk of exploitation.