Skip to main content
CVE-2026-71802VulnerabilityPublished 09/09/2026Updated 09/14/2026

CVE-2026-71802: n/a

Source CVE Database V5

0

Not known to be exploited · CVSS 5.4 Medium.

Data as of 10/24/2026, 22:16:04 UTC

CVSS 3.1 base score
5.4Medium
How severe the flaw is on the 0–10 CVSS scale.
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What to do

AI-suggested

Until a fix is available, restrict who can create or modify announcement content to trusted administrators only to reduce risk.

Description

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.

Impact

An attacker with the ability to control announcement content can execute arbitrary JavaScript in the context of users' browsers viewing the affected pages. This can lead to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires at least low privileges with user interaction. No known exploits in the wild have been reported.

Weaknesses

References

Community reviews

Loading reviews…