High [CVE-2026-11425] Stored cross-site scripting allows administrator account takeover
This high-severity Red Hat Linux advisory covers CVE-2026-11425.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API.
The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover. A flaw was found in Domoticz.
This allows the attacker to inject malicious code by updating specific device values through the application's programming interface (API).
Exploitation requires low-privileged API access to push malicious scripts into device payload fields, which subsequently execute in an administrator's browser upon accessing the mobile dashboard, potentially compromising administrative session confidentiality and system integrity.
This vulnerability strictly impacts Confidentiality and Integrity with zero impact on Availability as it does not disrupt service operation. Environments operating without mobile dashboard usage or where device updating APIs are strictly restricted to trusted internal networks remain unaffected.
Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).
- < 2026.3
Official advisory · high-confidence parse· fetched 30 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 30 days ago·verify at source
Mitigation checklist
- To mitigate this issue, restrict network access to the Domoticz API and mobile dashboard to trusted internal networks only. If the mobile dashboard functionality is not required, consider disabling or restricting access to it to prevent exploitation.
Official advisory · high-confidence parse· fetched 30 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.