Executive Summary

CVE-2026-24906 is a stored cross-site scripting (XSS) vulnerability in the Backend Editor Settings of OctoberCMS, specifically in the Markup Classes fields used for paragraph styles, inline styles, and table styles.

These fields did not properly sanitize input to allow only valid CSS class name characters, which allowed malicious JavaScript code to be stored.

When these malicious values are rendered unsanitized in the Froala editor dropdown menus within the RichEditor interface, JavaScript executes as soon as any user opens the editor.

Exploitation requires authenticated backend access with editor settings permissions and can lead to privilege escalation if a superuser opens any RichEditor instance during routine content editing.

The vulnerability affects versions prior to 3.7.14 and 4.1.10 and has been fixed in those versions.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with authenticated backend access and editor settings permissions to inject malicious JavaScript code that executes when any user opens the RichEditor.

The impact includes potential privilege escalation, especially if a superuser opens the editor, which could lead to unauthorized actions or control within the CMS.

Routine content editing operations become attack vectors, increasing the risk of compromise for users with elevated permissions.

Until patched, the risk can be mitigated by restricting editor settings permissions to fully trusted administrators only.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored malicious input in the Markup Classes fields of the Backend Editor Settings in OctoberCMS versions prior to 3.7.14 and 4.1.10. Detection involves checking for unsanitized or suspicious CSS class names in these fields.

Since the vulnerability requires authenticated backend access with editor settings permissions, detection can focus on reviewing the content of the Markup Classes fields in the backend editor settings for any unusual or suspicious characters or scripts.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade OctoberCMS to versions 3.7.14 or 4.1.10 or later, where this vulnerability has been fixed.

As a temporary workaround before upgrading, restrict editor settings permissions exclusively to fully trusted administrators to reduce the risk of exploitation.

Useful 0 Not Useful 0