High severity7.3NVD Advisory· Published Sep 17, 2026· Updated Sep 18, 2026
CVE-2026-76154
CVE-2026-76154
Description
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
Affected products
3- osv-coords2 versions
>= 12.3.0, < 12.3.1+ 1 more
- (no CPE)range: >= 12.3.0, < 12.3.1
- (no CPE)range: < 12.4.11-1.1
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.