openEQUELLA versions prior to 2026.2 have a stored cross-site scripting (XSS) vulnerability in the pre-login notice feature. The notice is stored as HTML and rendered on the legacy login page without proper encoding or sanitization. Users with the EDIT_SYSTEM_SETTINGS permission can inject arbitrary scripts via the pre-login notice API endpoint. If this permission is granted to guest or Everyone users, unauthenticated exploitation is possible.