CVE-2026-4313 is a stored XSS vulnerability in C&F AdaptiveGRC affecting versions before December 2025. The issue arises from improper neutralization of input in text fields submitted via HTTP POST requests, allowing authenticated attackers to inject arbitrary JavaScript. This can result in execution of malicious scripts in victim browsers, potentially compromising administrator tokens and enabling unauthorized administrative actions. The vulnerability has a low CVSS 4.0 score of 2.4, reflecting limited attack vector and impact scope. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators. This can lead to theft of administrator authentication tokens and unauthorized administrative actions, increasing the risk of further compromise within the affected system. However, the overall severity is rated low due to attack complexity and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure by restricting authenticated user privileges where possible and monitoring for suspicious activity related to input fields. Avoid relying solely on client-side controls for input validation.