Cross-Site Scripting (XSS) in Bacularis Pool Configuration

Executive Summary

CVE-2026-95166 is a stored Cross-Site Scripting (XSS) vulnerability in Bacularis versions 1.0.0 to 6.5.1. It allows an attacker with admin or specific role privileges to inject a malicious script via the LabelFormat field in the Pools / Add pool section. The script executes when viewing pool details and triggering an Update pool action.

Useful 0 Not Useful 0

Detection Guidance

Check Bacularis versions between 1.0.0 and 6.5.1. Inspect the LabelFormat field in the Pools / Add pool section for any suspicious scripts or payloads. Review pool details and Update pool actions for unexpected script execution.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. This could lead to unauthorized access, data theft, or further compromise of the system if users interact with the infected pool details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Bacularis to version 6.5.2 or later immediately. Remove any untrusted scripts from the LabelFormat field in existing pools. Restrict administrator and PoolList/PoolView roles to trusted users only.

Useful 0 Not Useful 0