CVE-2026-27787 is a cross-site scripting vulnerability affecting MATCHA SNS versions 1.3.9 and earlier by ICZ Corporation. This vulnerability allows an attacker to inject and execute arbitrary scripts in the context of a user's browser when they access the vulnerable web application. The CVSS 3.0 vector indicates the attack requires network access, low attack complexity, low privileges, and user interaction, with partial impact on confidentiality and integrity but no impact on availability. No official remediation or patch has been disclosed as of the publication date.

Successful exploitation could lead to execution of arbitrary scripts in the user's browser, potentially resulting in data disclosure or manipulation within the context of the affected application. The impact is rated medium due to limited scope and requirements for user interaction and privileges. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with the affected application and consider applying any available workarounds or input sanitization measures if possible.