CVE-2026-113712: cachet <= 2.4.1

Affected technology

cachet · <= 2.4.1
cachethq

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · Passive user interaction

What an attacker can do

An authenticated attacker can inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality, integrity and availability impact as none.