CVE-2026-23880
Unknown Unknown - Not Provided
Stored XSS in OnboardLite Dashboard Affects Admins

Publication date: 2026-01-19

Last updated on: 2026-01-19

Assigner: GitHub, Inc.

Description
OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-19
Last Modified
2026-01-19
Generated
2026-06-16
AI Q&A
2026-01-19
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23880
EUVD
EUVD-2026-3283
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
unknown_vendor onboardlite to 1d32081a66f21bcf41df1ecb672490b13f6e429f (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-23880 is a stored Cross-Site Scripting (XSS) vulnerability in the OnboardLite application, specifically in the admin dashboard's user Discord account migration feature. It occurs because user-controlled input, such as first and last names, is rendered unsafely using JavaScript's innerHTML, allowing malicious scripts to be stored and executed when an admin views the data. The vulnerability was fixed by replacing unsafe innerHTML usage with safe DOM manipulation methods that insert text content without executing scripts. [1, 2]

Impact Analysis

This vulnerability can allow an attacker with low privileges to inject malicious scripts that execute in the admin's browser when they attempt to migrate a user's Discord account. This can lead to an admin account takeover by hijacking the admin session or performing unauthorized actions, compromising the confidentiality and integrity of the system. [2]

Detection Guidance

This vulnerability can be detected by testing the admin dashboard's Discord account migration feature for stored XSS by attempting to input malicious scripts in user fields such as first and last names and observing if the scripts execute when an admin migrates the Discord account. Specifically, monitoring requests to the endpoint `/admin/get_by_snowflake/?discord_id=${discord_id}` for suspicious payloads can help detect exploitation attempts. There are no specific commands provided in the resources, but manual testing or using web vulnerability scanners targeting stored XSS in the admin interface is recommended. [2]

Mitigation Strategies

The immediate mitigation step is to update OnboardLite to a version that includes the patch from commit 1d32081a66f21bcf41df1ecb672490b13f6e429f or later. This patch replaces unsafe usage of `innerHTML` with secure DOM manipulation methods that prevent stored XSS. Until the update is applied, restrict admin access and avoid migrating Discord accounts from untrusted users to reduce risk. [1, 2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart