CVE-2026-4313
Full vulnerability record from the local CVENow database.
Description
AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser. Critically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise. This issue occurs in versions released before December 2025.
Severity
LOW
CVSS score
2.4
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-04-24 12:17:07.430000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-4313",
"sourceIdentifier": "[email protected]",
"published": "2026-04-24T12:17:07.430",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser.\nCritically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise.\n\nThis issue occurs in versions released before December 2025."
},
{
"lang": "es",
"value": "AdaptiveGRC es vulnerable a XSS Almacenado a través de campos de tipo texto en los formularios. Un atacante autenticado puede reemplazar el valor del campo de texto en la solicitud HTTP POST. La validación incorrecta de parámetros por parte del servidor resulta en la ejecución arbitraria de JavaScript en el navegador de la víctima.\nCríticamente, esto puede permitir al atacante obtener el token de autenticación del administrador y realizar acciones arbitrarias con privilegios administrativos, lo que podría llevar a un mayor compromiso.\n\nEste problema ocurre en versiones lanzadas antes de diciembre de 2025."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "C&F",
"product": "AdaptiveGRC",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.420.00",
"lessThan": "5.420.66",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.444.119",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.448.116",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.453.110",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.454.64",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.455.87",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.456.60",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.499.113",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "C&F",
"product": "AdaptiveGRC",
"defaultStatus": "unaffected",
"modules": [
"Angular"
],
"versions": [
{
"version": "5.420.00",
"lessThan": "5.420.14",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.423.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.444.20",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.448.42",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.449.40",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.453.19",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.454.17",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.420.00",
"lessThan": "5.456.20",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.4,
"baseSeverity": "LOW",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-24T12:01:03.434783Z",
"id": "CVE-2026-4313",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://adaptivegrc.com/pl/wszystkie-procesy-grc-w-jednym-narzedziu/",
"source": "[email protected]"
},
{
"url": "https://cert.pl/posts/2026/04/CVE-2026-4313",
"source": "[email protected]"
}
]
}