CVE-2026-23926 is a vulnerability where an authenticated administrator without superuser privileges can inject JavaScript code into a maintenance period tooltip. This malicious script executes when any user views the tooltip in the Host navigator widget, potentially allowing unauthorized actions. The vulnerability has a high severity with a CVSS score of 6.8. No specific affected software versions or patches are provided in the available data.