CVE-2026-121578

    Dashboard / Vulnerabilities / CVE-2026-121578

    CVE-2026-121578

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: CVE-2026-121578

    Details: Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

    References: https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121578.json, https://nvd.nist.gov/vuln/detail/CVE-2026-121578, https://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd08

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ba5363ea99cf776511e5c828b6d744e4d0bddd08

    Affected versions

    v0.101.46
    v0.101.45
    v0.101.42
    v0.101.41
    v0.101.33
    v0.101.32
    v0.101.27-dev
    v0.101.26-dev
    v0.101.24-dev
    v0.101.23-dev
    v0.101.21-dev
    v0.101.19-dev
    v0.101.17-dev
    v0.101.15-dev
    v0.101.14-dev
    v0.101.12-dev
    v0.101.10-dev
    v0.101.8-dev
    v0.101.6-dev
    v0.101.4-dev
    v0.101.2-dev
    v0.101.1-dev

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121578 | CVE-DB