{"id":"CVE-2026-44977","summary":"countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context","details":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.","aliases":["GHSA-jqp4-p86c-phxc"],"modified":"2026-10-17T02:48:34.384433079Z","published":"2026-10-16T16:04:45.868Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44977.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44977.json"},{"type":"FIX","url":"https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631"},{"type":"FIX","url":"https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41"},{"type":"WEB","url":"https://github.com/Countly/countly-server/releases/tag/24.05.50"},{"type":"WEB","url":"https://github.com/Countly/countly-server/releases/tag/25.03.44"},{"type":"ADVISORY","url":"https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44977"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/countly/countly-server","events":[{"introduced":"0"},{"fixed":"e702a104d7616b1a96458da9fbf36144c5dd5ef4"},{"introduced":"5890b94d9783feffa3d2acafba1d94d67b2ae4e6"},{"fixed":"6050a3b1bcb0376701dbf68e346ac261363f5dfa"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"24.05.50"},{"introduced":"25.03"},{"fixed":"25.03.44"}],"source":"AFFECTED_FIELD"}}],"versions":["24.05.49","25.03.43","25.03.42","25.03.41","25.03.40","25.03.39","25.03.38","25.03.37","25.03.36","25.03.35","25.03.34","25.03.29","25.03.33","v25.03.32","25.03.31","24.05.48","25.03.30","24.05.47","25.03.28","24.05.46","25.03.27","25.03.26","24.05.45","24.05.44","25.03.25","24.05.43","25.03.24","25.03.23","24.05.42","24.05.41","25.03.22","25.03.21","24.05.40","25.03.20","24.05.39","24.05.38","25.03.19","24.05.37","25.03.18","25.03.17","25.03.16","25.03.15.test","25.03.15","25.03.14","25.03.13","25.03.12","24.10.12","24.05.36","25.03.11","24.05.35","v24.05.34","v25.03.10","v25.03.9","v24.05.33","v25.03.8","v25.03.7","v24.05.32","v25.03.6","25.03.5","24.05.31","24.05.28","25.03.4","24.03.4","24.05.30","24.05.29","25.03.3","25.03.2","24.05.27","24.05.26","25.03.0","24.05.25","24.05.24","24.05.23","24.05.22","24.05.21","24.05.20","24.05.19","24.05.18","24.05.17","24.05.16","24.05.14","24.05.15","24.05.13","24.05.12","24.05.11","24.05.10","24.05.9","24.05.8","24.05.7","24.05.3","24.05.6","24.05.5","25.05.4","24.05.2","24.05.1","24.05","23.03","23.11.22","23.11.21","23.11.20","23.11.19","23.11.18","23.11.17","23.11.16","23.11.15","23.11.14","23.11.13","23.11.12","23.11.10","23.11.11","23.11.9","23.11.8","23.7.11.hooks-vm","23.11.7","23.11.test","23.11.6","23.11.5","23.11.4","23.11.3","23.11.2","23.11.1","23.11","23.06.16","23.06.15","23.06.14","23.06.13","23.06.12","23.06.11","23.06.10","23.06.9","23.06.8","23.06.7","23.06.6","23.06.5","23.06.4","23.06.3","23.06.2","23.06.1","22.09.19","23.06","23.03.9","23.03.8","23.03.7","23.03.6","23.03.5","23.03.4","23.03.3","23.03.2","23.03.1","22.09.18","22.09.17","22.09.16","22.09.15","22.09.13","22.09.14","22.09.12","22.09.11","v22.09.test3","v22.09.test2","v22.09.test1","v22.09.test","22.09.10","22.09.9","22.09.8","22.09.test","v22.09.7","v22.09.5","v22.09.6","v22.09.4","v22.09.3","v22.09.2","v22.09.1","v22.09","v22.08.6","v22.08.5","v22.08.4","v22.08.3","v22.08.2","v22.08.1","v22.08","v22.06.5","v22.06.4","v22.06.3","v22.06.2","v22.06.1","v22.06","v22.03.12","v22.03.11","v22.03.10","v22.03.9","v22.03.8","v22.03.7","v21.11.4","v22.03.6.2","v22.03.6.1","v22.03.6","22.03.6","v22.03.5","v22.03.4","v22.03.3","v22.03.2","v22.03.1","v22.03","v21.11.3","v21.11.2","v21.11.1","v21.11","v20.11.2","v20.11.1","v20.11","SERVER-1658","v19.02","v18.08","v18.04.1","v18.04","v18.01.1","v18.01","v17.09","v17.05","v16.12","16.06","16.02.1","v14.08","v13.10","countly-server-v13.06"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44977.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}