CVE-2026-113712

UNKNOWN 0.0

Cachet has Stored XSS in Incident Component

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.

CWE	CWE-79
Vendor	cachethq
Product	cachet
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for cachethq cachet

Be the first to know when new unknown vulnerabilities affecting cachethq cachet are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

cachethq / cachet

<= 2.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9 github.com: https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2 github.com: https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e