CVE-2026-66092

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDITSYSTEMSETTINGS permission can set a notice containing an arbitrary script PUT /api/preloginnotice, resulting in stored cross-site...

CVE-2026-66089

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations SSRF...

CVE-2026-66090

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items CREATEITEM can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make request...

CVE-2026-66088

In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...

CVE-2026-66091

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66089

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations SSRF...

CVE-2026-66090

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items CREATEITEM can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make request...

CVE-2026-66091

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66088

In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...

CVE-2026-16889

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-16889

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-66092 Stored XSS in pre-login notice via reachable legacy logon route

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDITSYSTEMSETTINGS permission can set a notice containing an arbitrary script PUT /api/preloginnotice, resulting in stored cross-site...

CVE-2026-66092

In openEQUELLA versions before 2026.2 , a stored cross-site scripting (XSS) vulnerability exists because the pre-login notice is stored as HTML and rendered on the legacy logon page without proper encoding or sanitization. An attacker with the EDIT_SYSTEM_SETTINGS permission can use the PUT /api/...

EUVD-2026-112568

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDITSYSTEMSETTINGS permission can set a notice containing an arbitrary script PUT /api/preloginnotice, resulting in stored cross-site...

CVE-2026-66091

In openEQUELLA versions prior to 2026.1 , the GET /api/userquery/userinfobackup endpoint is vulnerable to an Insecure Direct Object Reference (IDOR) because it fails to perform adequate authentication or authorization checks. An unauthenticated attacker can provide a victim's uniqueId to retrieve...

EUVD-2026-112567

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66091 Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66090

The software openEQUELLA (versions before 2026.1 ) is vulnerable to an XML External Entity (XXE) Injection vulnerability within its item metadata XML parser. An attacker with CREATE_ITEM privileges can submit crafted XML via a POST /api/item request. This flaw allows the attacker to force the ser...

EUVD-2026-112566

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items CREATEITEM can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make request...

CVE-2026-66090 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items CREATEITEM can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make request...