CVE-2026-91922

MediumCVSS 6.1

Published: 15/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.

Risk Assessment

Reflected XSS enables theft of authentication tokens and session hijacking. It can lead to unauthorized access to the platform and privilege escalation.

Recommendation

Update Steedos Platform to a version later than 3.0.15-beta.47 that fixes parameter escaping. Deploy CSP headers and input validation on the /api/page/render endpoint.

Other vulnerabilities in Steedos Platform

CVE-2026-111666Medium
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS