CVE-2026-41469 identifies a protection mechanism failure in Beghelli Sicuro24 SicuroWeb due to the absence of a Content Security Policy. This allows unrestricted loading of external JavaScript resources from attacker-controlled origins. When combined with existing template injection and sandbox escape vulnerabilities in the application, the lack of CSP removes browser-enforced restrictions that would otherwise prevent execution of arbitrary remote scripts. This vulnerability is classified under CWE-693 and has a CVSS 4.0 score of 5.1 (medium severity). No official remediation or patch is currently documented, and the product is not cloud-hosted.

The vulnerability enables attackers to load and execute arbitrary external JavaScript in operator browser sessions by bypassing browser security controls that would normally be enforced by a Content Security Policy. This can lead to unauthorized script execution within the context of the application, potentially compromising the integrity of operator sessions. However, exploitation requires chaining with other vulnerabilities (template injection and sandbox escape) present in the same application. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, consider implementing compensating controls such as manually enforcing CSP headers if possible, or restricting access to the affected application to trusted users only. Avoid relying solely on browser security mechanisms given the absence of CSP enforcement.