{"id":"CVE-2026-76154","title":"A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…","summary":"A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escal…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-79"],"vendor":"Grafana","product":"Grafana OSS","affected":["oss 12.3.0","oss >= 12.4.0 <= 12.4.10","oss >= 13.0.0 <= 13.0.8","oss >= 13.1.0 <= 13.1.5","oss >= 13.2.0 <= 13.2.1","enterprise 12.3.0","enterprise >= 12.4.0 <= 12.4.10","enterprise >= 13.0.0 <= 13.0.8","enterprise >= 13.1.0 <= 13.1.5","enterprise >= 13.2.0 <= 13.2.1"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:34:36.657","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76154","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-76154","label":"security@grafana.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76154.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-76154"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528028"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76154"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76154"},{"url":"https://access.redhat.com/errata/RHSA-2026:74164"},{"url":"https://access.redhat.com/errata/RHSA-2026:73655"},{"url":"https://access.redhat.com/errata/RHSA-2026:76430"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00353,"epssPercentile":0.28751,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-18T17:33:54.472083Z"},"ingestedAt":"2026-09-17T21:29:16.985Z","patched":["hardened_images"],"slug":"CVE-2026-76154","body":"## Overview\n\nA stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:74164** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74164)\n- **RHSA-2026:73655** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73655)\n- **RHSA-2026:76430** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76430)\n- **Red Hat VEX** · Important · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Ceph Storage 7, … · no fix planned: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76154.json)","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}