CVE-2026-116047 Privoce CVE debrief

Who should care

Defenders responsible for Privoce Vocechat installations, particularly those using versions up to 0.9.121, should assess their exposure and prioritize verification and mitigation efforts.

Why it matters

CVE-2026-116047 is a cross-site scripting vulnerability in Privoce Vocechat up to version 0.9.121. Defenders should verify exposure, prioritize patching, and monitor for exploitation attempts due to the remote attack vector and public exploit disclosure.

• Defenders need to verify the presence of this vulnerability in their systems.
• Cross-site scripting attacks can be launched remotely, potentially leading to unauthorized actions.
• Applying patches or mitigations is crucial to prevent exploitation.
• The lack of vendor response to the disclosure adds uncertainty to the vulnerability's impact.

Technical summary

The vulnerability affects Privoce Vocechat up to version 0.9.121 and is caused by improper handling of the welcome argument in the widget.html file. This allows for cross-site scripting attacks, which can be launched remotely. Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available. The attack vector is remote, and the exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available.

Recommended defensive actions

• Verify the presence of this vulnerability in Privoce Vocechat installations up to version 0.9.121.
• Apply patches or mitigations as available to prevent cross-site scripting attacks.
• Monitor systems for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the vendor did not respond to the disclosure, and there is limited information about the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.