CVE-2026-44977countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
Updated under an hour ago ()
Does this affect you?
It affects countly-server. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.
- CVSS
- 9.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
Affected products
Countly countly-server countly:server (from the name) | before 24.05.50; from 25.03, < 25.03.44 | CNA record |
References
- https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxcx-refsource-confirm
- https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631x-refsource-misc
- https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41x-refsource-misc
- https://github.com/Countly/countly-server/releases/tag/24.05.50x-refsource-misc
- https://github.com/Countly/countly-server/releases/tag/25.03.44x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.