CVE-2026-78213 is a stored Cross-Site Scripting (CWE-79) vulnerability in Heptabase, a product by Hepta Platforms. Authenticated attackers can inject persistent malicious JavaScript into certain pages, which executes when other users click the injected content. This can lead to a complete compromise of confidentiality and integrity of affected users' sessions. The CVSS 3.1 score is 8.7, reflecting network attack vector, low attack complexity, required privileges, user interaction, and scope change with high impact on confidentiality and integrity but no impact on availability. No patch or official remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of other users, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of victims. The vulnerability affects confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting authenticated user privileges and exercising caution when interacting with content from untrusted users.