Reflected XSS in Cacti via auth_profile.php tab parameter

Compliance Impact

The CVE-2026-39900 vulnerability is a reflected Cross-Site Scripting (XSS) issue in the Cacti software that allows malicious JavaScript code execution in users' browsers. Such vulnerabilities can potentially lead to unauthorized access to user data or session hijacking.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, reflected XSS vulnerabilities generally pose risks to data confidentiality and integrity, which are critical aspects of these regulations.

Organizations using affected versions of Cacti (1.2.30 and prior) may face increased risk of non-compliance if this vulnerability is exploited, as it could lead to unauthorized disclosure or manipulation of personal or sensitive data.

The vulnerability has been fixed in version 1.2.31 with proper input validation and output escaping, which helps mitigate these risks and supports compliance efforts.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability CVE-2026-39900 is a reflected Cross-Site Scripting (XSS) issue in the Cacti software, specifically involving the unescaped 'tab' parameter in the auth_profile.php JavaScript context.

To detect this vulnerability on your system, you can attempt to send crafted HTTP requests to the vulnerable endpoint and observe if the 'tab' parameter is reflected without proper escaping, which would indicate susceptibility to XSS.

A simple command using curl to test for this reflected XSS might be:

• curl -i -s -k "http://<cacti-server>/auth_profile.php?tab=<script>alert('XSS')</script>"

If the response contains the injected script tag unescaped in the JavaScript context, the system is vulnerable.

Alternatively, you can use web vulnerability scanners that support reflected XSS detection against the auth_profile.php endpoint with the 'tab' parameter.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-39900 is a vulnerability in Cacti, an open source performance and fault management framework. Versions 1.2.30 and earlier are affected by a Reflected Cross-Site Scripting (XSS) vulnerability. This occurs via the 'tab' parameter in the auth_profile.php file within a JavaScript context. The vulnerability allows an attacker to inject malicious scripts that are reflected back to the user.

This issue has been fixed in version 1.2.31 of Cacti.

Useful 0 Not Useful 0

Impact Analysis

The Reflected XSS vulnerability can allow attackers to execute malicious scripts in the context of a user's browser session when they interact with the vulnerable parameter. This can lead to theft of user credentials, session hijacking, or performing actions on behalf of the user without their consent.

Since the vulnerability requires user interaction (UI:P), the attacker typically needs to trick the user into clicking a crafted link or visiting a malicious page.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Cacti to version 1.2.31 or later, as this version contains the fix for the Reflected XSS issue via the tab parameter in auth_profile.php.

Useful 0 Not Useful 0