CVE-2026-4313

Vulnerability

AdaptiveGRC is susceptible to stored cross-site scripting (XSS) due to improper neutralization of user-supplied input in text fields within forms. An authenticated attacker can replace the value of a text field in an HTTP POST request, and the server fails to validate the parameter correctly, resulting in arbitrary JavaScript execution in the victim's browser [2].

Exploitation

The attack requires an authenticated user to craft a malicious payload and submit it via a text field. The injected script is stored on the server and later executed when a victim, such as an administrator, views the affected form. No additional privileges beyond a valid user account are needed to inject the script [1], [2].

Impact

Successful exploitation may allow the attacker to obtain the administrator's authentication token. With this token, the attacker can perform arbitrary actions with administrative privileges, potentially leading to further compromise of the AdaptiveGRC instance and its associated data [2].

Mitigation

The vulnerability affects versions released before December 2025. Users should upgrade to a patched version provided by the vendor (C&F). No workaround is mentioned in the available references [1], [2].