The vulnerability CVE-2026-7677 affects kerwincui FastBee up to version 1.2.1 in the Add function of the System Notice Handler component. It arises from improper handling of the noticeContent argument in the SysNoticeController.java source file, enabling cross-site scripting attacks. The vulnerability can be exploited remotely without privileges or user interaction. Although publicly disclosed, no official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks by injecting malicious scripts into the noticeContent parameter. This could lead to the execution of arbitrary scripts in the context of the affected application, potentially compromising user sessions or data. However, the CVSS score and description indicate the impact is limited to medium severity with no direct privilege escalation or confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying input validation or output encoding on the noticeContent parameter as a temporary mitigation. Monitoring for updates from the vendor or community for an official patch is recommended.