CVE-2026-61986 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Contest Gallery versions up to 30.0.5. The vulnerability allows remote attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low to low to low respectively.

Successful exploitation could allow attackers to execute arbitrary scripts in users' browsers without authentication, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should apply relevant mitigations as recommended by the vendor once disclosed.