CVE-2026-91922 in Steedos
Summary
by MITRE • 09/15/2026
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The Steedos Platform, specifically versions up through 3.0.15-beta.47, contains a critical reflected cross-site scripting vulnerability located within its anonymous API endpoint for page rendering. This security flaw stems from an improper neutralization of special elements used in scripts during the processing of user-supplied input. The specific point of failure is found in how the application handles query parameters passed to the /api/page/render endpoint, particularly those designated as schemaApi and data. When these parameters are processed, the platform fails to adequately escape or sanitize potentially malicious content before injecting it into inline script elements within the generated HTML response. This lack of proper input validation allows an attacker to inject executable JavaScript code directly into the context of a victim's browser session.
From a technical perspective, this vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The mechanism of exploitation relies on crafting malicious URLs where the query parameters contain script-terminating sequences or direct JavaScript payloads. Because the endpoint is anonymous and does not require authentication to access initially, it presents a low barrier for entry for attackers seeking to launch phishing campaigns or session hijacking attacks. Once the victim clicks the crafted link, their browser interprets the injected code as part of the legitimate page content, leading to the execution of arbitrary scripts within the security context of the Steedos application domain.
The operational impact of this vulnerability is severe due to its ability to facilitate credential theft and unauthorized access. By executing arbitrary JavaScript in the victim's session, an attacker can intercept sensitive authentication tokens stored in memory or cookies. Specifically, the threat actor targets the X-Auth-Token header value, which serves as a critical component for maintaining authenticated sessions within the Steedos ecosystem. The successful exploitation of this flaw allows the adversary to steal these credentials and subsequently impersonate the victim user. This leads to unauthorized access to confidential business data, potential modification or deletion of records, and further lateral movement within the organization's infrastructure if the compromised account possesses elevated privileges.
In terms of threat modeling, this attack vector aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under sub-techniques involving JavaScript execution in a web browser context such as Web Browser Rendering or DOM-based XSS. The reflected nature of the XSS means that the payload is not stored on the server but is instead delivered via external links, often requiring social engineering tactics to entice users into visiting the malicious URL. This method bypasses many traditional security controls that focus on persistent storage vulnerabilities and requires careful monitoring of outbound traffic or input validation at the application layer.
To mitigate this vulnerability, immediate action should be taken by upgrading the Steedos Platform to a version later than 3.0.15-beta.47 where these issues have been addressed in subsequent releases. For organizations unable to upgrade immediately, implementing strict input validation and output encoding on all query parameters processed by the /api/page/render endpoint is essential. Developers should ensure that any data inserted into inline script elements is properly escaped using context-aware encoding techniques to prevent the browser from interpreting injected strings as executable code. Additionally, deploying a Web Application Firewall with rules capable of detecting common XSS payloads in URL parameters can provide an additional layer of defense against exploitation attempts while patching efforts are underway.