CVE-2026-24907

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to update immediately, workarounds include restricting mail template editing permissions to fully trusted administrators only and restricting Event Log viewing permissions to minimize exposure.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/octobercms/october/security/advisories/GHSA-j4j5-9x6g-rgxc	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:octobercms:october::::::::
	cpe:2.3:a:octobercms:october::::::::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) October es un Sistema de Gestión de Contenidos (CMS) y plataforma web. Las versiones anteriores a 3.7.14 y 4.1.10 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la función de vista previa de correo del Registro de Eventos. Al ver los mensajes de correo registrados, el contenido HTML se renderizaba en un iframe sin un sandboxing adecuado, permitiendo la ejecución de JavaScript en el contexto del navegador del visor. Este problema ha sido solucionado en las versiones 3.7.14 y 4.1.10. Si los usuarios no pueden actualizar de inmediato, las soluciones provisionales incluyen restringir los permisos de edición de plantillas de correo solo a administradores de plena confianza y restringir los permisos de visualización del Registro de Eventos para minimizar la exposición.

Information

Published : 2026-04-14 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-24907

Mitre link : CVE-2026-24907

CVE.ORG link : CVE-2026-24907

JSON object : View

Products Affected

octobercms

october

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-24907", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24907", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T19:29:36.293917Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": "< 3.7.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.10"}]}]}], "published": "2026-04-14T18:16:45.233", "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-j4j5-9x6g-rgxc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to update immediately, workarounds include restricting mail template editing permissions to fully trusted administrators only and restricting Event Log viewing permissions to minimize exposure."}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Las versiones anteriores a 3.7.14 y 4.1.10 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la funci\u00f3n de vista previa de correo del Registro de Eventos. Al ver los mensajes de correo registrados, el contenido HTML se renderizaba en un iframe sin un sandboxing adecuado, permitiendo la ejecuci\u00f3n de JavaScript en el contexto del navegador del visor. Este problema ha sido solucionado en las versiones 3.7.14 y 4.1.10. Si los usuarios no pueden actualizar de inmediato, las soluciones provisionales incluyen restringir los permisos de edici\u00f3n de plantillas de correo solo a administradores de plena confianza y restringir los permisos de visualizaci\u00f3n del Registro de Eventos para minimizar la exposici\u00f3n."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A07FA7C9-BC27-4953-93C7-AB142B989CC2", "versionEndIncluding": "3.7.13"}, {"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C5346C3-F4C0-4DD0-AAAC-A12A7EB93C8F", "versionEndIncluding": "4.1.9", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}