CVE-2026-90821: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Arcadia Technology, LLC Crafty Controller

This vulnerability (CVE-2026-90821) is a stored cross-site scripting (CWE-79) issue in the Webhook URL form field of Crafty Controller by Arcadia Technology, LLC. An authenticated remote attacker can submit malicious input that is not properly neutralized during web page generation, leading to stored XSS. The vulnerability affects versions >=4.2.0 and <4.11.0. The CVSS 3.1 base score is 5.4 (medium), with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity with no availability impact. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated attacker to inject and store malicious scripts in the Webhook URL form field, which can execute in the context of other users viewing the affected pages. This can lead to partial confidentiality and integrity compromise. There is no reported impact on availability. No known active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to authenticated users and carefully validate or sanitize inputs to the Webhook URL form field if possible. Monitor vendor communications for official patches or updates.