CVE-2026-24907 Octobercms CVE debrief

Who should care

Administrators with mail template editing permissions and users with Event Log viewing permissions should assess exposure and prioritize patching or mitigation. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and plan vendor-supported updates or mitigat

Why it matters

Defenders should prioritize patching or mitigating this stored cross-site scripting (XSS) vulnerability in October CMS, especially for administrators with mail template editing permissions and users with Event Log viewing permissions, as it could lead to JavaScript execution in the viewer's browser context.

• Potential JavaScript execution in the viewer's browser context
• Elevation of privileges for attackers
• Data theft or unauthorized actions
• Reputation damage due to successful attacks

Technical summary

The vulnerability exists in the Event Log mail preview feature of October CMS, where HTML content is rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context. This issue has been fixed in versions 3.7.14 and 4.1.10. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. The CVE record and NVD detail page provide additional technical context and source-grounded vulnerability information. Defenders should prioritize patching or mitigating this vulnerability, especially for administrators with mail template editing permissions and users with Event Log viewing permissions.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for administrators with mail template editing permissions and users with Event Log viewing permissions.

Recommended defensive actions

• Patch to versions 3.7.14 or 4.1.10
• Restrict mail template editing permissions to fully trusted administrators
• Restrict Event Log viewing permissions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the fixed versions. The vulnerability exists in October CMS versions prior to 3.7.14 and 4.1.10. Evidence from the CVE Program and NVD detail page indicates that the vulnerability allows JavaScript execution in the viewer's browser context due to improper sandboxing of HTML content in the Event Log mail preview feature. Defenders should verify affected product deployments and review official advisories for validation of affected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.