CVE-2026-11425

Received Received - Intake

Stored XSS in Domoticz Mobile Dashboard via API Device Updates

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulnCheck

Description

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-11425

EUVD

EUVD-2026-54647

Affected Vendors & Products

Vendor	Product	Version / Range
domoticz	domoticz	to 2026.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Domoticz versions before 2026.3. It allows authenticated attackers to inject malicious HTML or JavaScript by modifying Text or Alert device values via the API. The mobile dashboard renders this data unsafely using ng-bind-html without proper HTML escaping, enabling stored payloads to execute in any administrator's browser when they view the dashboard.

Detection Guidance

Check Domoticz versions prior to 2026.3 for the vulnerability. Inspect API logs for unauthorized Text or Alert subtype device value updates. Review mobile dashboard HTML responses for unescaped JavaScript payloads.

Impact Analysis

Attackers could steal session cookies or take over administrator accounts by injecting malicious scripts. This could allow unauthorized access to the Domoticz system, manipulation of device controls, or exposure of sensitive data viewed in the mobile dashboard.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling session cookie theft and account takeover. Stored XSS in the mobile dashboard may allow attackers to access sensitive user data, which could violate data protection requirements under these regulations.

Mitigation Strategies

Upgrade Domoticz to version 2026.3 or later. Restrict API access to trusted users. Sanitize device value inputs to prevent HTML/JS injection. Monitor mobile dashboard for suspicious activity.

Hi! I’m here to help you understand CVE-2026-11425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70