CVE-2026-33402Sakai is a Collaboration and Learning Environment (CLE).
Updated under an hour ago ()
Does this affect you?
It affects sakailms sakai. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Sakai is a Collaboration and Learning Environment (CLE). In versions 23.0 through 23.4 and 25.0 through 25.1, group titles and description can contain cross-site scripting scripts. The patch is included in releases 25.2 and 23.5. As a workaround, one can check the SAKAI_SITE_GROUP table for titles and descriptions that contain this info.
- CVSS
- 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
sakailms sakai sakailms:sakai | from 23.0 before 23.5; from 25.0 before 25.2 | NVD |
References
- https://github.com/sakaiproject/sakai/security/advisories/GHSA-6g62-3898-hpvmvendor-advisory
- https://sakaiproject.atlassian.net/browse/SAK-52311permissions-required
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.