The vulnerability CVE-2026-76203 in maalfer Pentestify (versions 1.2.0 through 2.3.2) is due to an incorrect behavior order where validation occurs before canonicalization in the CSS sanitizer for report themes. This allows an authenticated attacker to use CSS hex escapes to reconstruct the url() function, evading the sanitizer's blocklist and forcing other users' browsers to make outbound HTTP requests. As a result, the attacker can disclose sensitive information such as the IP address and User-Agent of other users. The issue is categorized under CWE-180 (Incorrect Behavior Order).

An authenticated attacker can cause other users' browsers to make outbound HTTP requests, which can lead to disclosure of their IP addresses and User-Agent strings. This can be used to gather information about users and potentially facilitate further attacks or tracking. There is no indication of remote code execution or data modification. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user capabilities to upload or modify CSS or report themes. Monitor for unusual outbound HTTP requests originating from user browsers related to the application. Follow vendor guidance once available.