CVE-2026-42197 is a stored cross-site scripting vulnerability in the RELATE courseware system affecting versions before commit 555f0efb1c5bd7531c07cd73724d7e566a81f620. The vulnerability is due to the get_user() method in ParticipationAdmin using Python's % string formatting combined with Django's mark_safe, which bypasses automatic HTML escaping. The get_full_name method returns values directly from the first_name and last_name fields of the User model, which are editable by any authenticated user without sanitization. When an administrator views the Participation list in the Django admin panel, the unsanitized input is rendered directly into the HTML response, enabling stored XSS and potential admin account takeover. The vulnerability has a CVSS 3.1 score of 8.7 (high severity). The issue is resolved by the commit 555f0efb1c5bd7531c07cd73724d7e566a81f620.

An attacker with authenticated user privileges can inject malicious JavaScript into their user profile fields, which executes in the browser of an administrator viewing the Participation list. This can lead to full administrator account takeover, compromising the integrity and security of the RELATE system. The vulnerability does not affect availability but has high confidentiality and integrity impact.

A fix is available in RELATE starting from commit 555f0efb1c5bd7531c07cd73724d7e566a81f620. Users should upgrade to this version or later to remediate the vulnerability. Since this is not a cloud service, patching the affected software instance is required. Patch status is confirmed by the vendor commit reference. No alternative mitigations are provided in the advisory.