CVE-2026-71802

Deferred Deferred - Pending Action

Stored XSS in Rebuild Admin Dashboard via Announcement Preview

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: MITRE

Description

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-71802

EUVD

EUVD-2026-75161

Affected Vendors & Products

Vendor	Product	Version / Range
rebuild	rebuild	4.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in REBUILD 4.4.3. The issue occurs in the announcement preview component where server-side HTML escaping is reversed by client-side code using jQuery's html().text() method. This allows injection of arbitrary JavaScript into the DOM when users view affected pages.

Detection Guidance

Check for suspicious announcement content in REBUILD 4.4.3 that contains executable JavaScript or HTML tags. Inspect DOM elements where announcements are rendered for unexpected script execution or injected code.

Impact Analysis

An attacker with access to create announcements could execute malicious JavaScript in the browsers of other users viewing those announcements. This could lead to session hijacking, data theft, or unauthorized actions performed on behalf of users, depending on their privileges.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized script execution in user browsers. If exploited, it may allow attackers to steal sensitive data, manipulate user sessions, or perform actions on behalf of users, which could lead to breaches of confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade REBUILD to a patched version if available. Disable or restrict announcement preview functionality until fixed. Implement input validation for announcement content to block HTML/script tags. Monitor for unusual activity in affected pages.

Hi! I’m here to help you understand CVE-2026-71802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70