Cross Site Scripting (XSS) in Bacularis Organization Name

Executive Summary

CVE-2026-95165 is a stored Cross-Site Scripting (XSS) vulnerability in Bacularis versions 5.4.0 through 6.5.1. Attackers can inject malicious scripts via the organization name field in the Security / Organizations section. The payload executes when a user linked to the compromised organization clicks the logout button.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the organization name field in the Security / Organizations section of Bacularis. Look for any entries containing script tags or unusual characters. Check if users report unexpected behavior when logging out.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of affected users' browsers. It can lead to session hijacking, unauthorized actions, data theft, or defacement. All users, including administrators and normal users, are impacted when they interact with the compromised organization.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Organizations must address this to maintain compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Bacularis to version 6.5.2 or later. If upgrading is not possible, remove or sanitize any suspicious organization names containing scripts. Restrict user permissions to reduce exposure.

Useful 0 Not Useful 0