CVE-2026-71802: n/a
Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 10/24/2026, 22:16:04 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NWhat to do
AI-suggested
Until a fix is available, restrict who can create or modify announcement content to trusted administrators only to reduce risk.
Description
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.
Impact
An attacker with the ability to control announcement content can execute arbitrary JavaScript in the context of users' browsers viewing the affected pages. This can lead to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires at least low privileges with user interaction. No known exploits in the wild have been reported.
Weaknesses
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.