PT-2026-32727 · October · October

Chris Alupului · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-24907

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.14 October versions prior to 4.1.10

Description A stored cross-site scripting (XSS) issue exists in the Event Log mail preview feature. HTML content in logged mail messages is rendered in an iframe without proper sandboxing, which allows JavaScript execution in the browser context of the viewer. This can lead to privilege escalation if a superuser views a malicious log entry. Exploitation requires authenticated backend access with mail template editing permissions and a superuser to view the specific Event Log entry.

Recommendations Update to version 3.7.14. Update to version 4.1.10. Restrict mail template editing permissions to fully trusted administrators only. Restrict Event Log viewing permissions to minimize exposure.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24907

GHSA-J4J5-9X6G-RGXC

Affected Products

October

References · 5

• https://github.com/octobercms/october/security/advisories/GHSA-j4j5-9x6g-rgxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24907 · Security Note
• https://osv.dev/vulnerability/GHSA-j4j5-9x6g-rgxc · Vendor Advisory
• https://github.com/octobercms/october · Note
• https://twitter.com/CVEnew/status/2044358540412776952 · Twitter Post