---
id: CVE-2026-111040
title: Multiple vulnerabilities in Coupa’s Total Spend Management Platform
summary: >-
  The platform allows persistent HTML injection into editable fields managed by
  TinyMCE. An authenticated attacker with low privileges can inject unsanitised
  HTML content which is stored in the database and subsequently rendered in
  other u…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-80
vendor: Coupa
product: Coupa Total Spend Management Platform
affected:
  - total_spend_management_platform < 04/11/2026
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T09:54:08.688Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111040'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform
tags:
  - cve.org
ingestedAt: '2026-11-05T20:33:06.727Z'
---

## Overview

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.

## Affected

- `total_spend_management_platform < 04/11/2026`

## Remediation

No solution has been reported as yet.