CVE-2026-4313 describes a stored XSS vulnerability (CWE-79) in C&F AdaptiveGRC affecting versions prior to December 2025, including version 5.420.00. The vulnerability arises from improper validation of text input fields in HTTP POST requests, allowing authenticated users to inject JavaScript that executes in other users' browsers. This can lead to theft of administrator tokens and unauthorized administrative actions. The CVSS 4.0 vector indicates the attack requires low complexity, authenticated user privileges, and user interaction, with limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to theft of administrator authentication tokens and unauthorized administrative actions. This could result in further compromise of the application and its data. However, the overall severity is rated low (CVSS 2.4), reflecting the need for authentication and user interaction and limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting authenticated user privileges where possible and monitoring for unusual administrative activity. Avoid relying solely on client-side protections, as the vulnerability stems from server-side input validation issues.