{"id":"CVE-2026-23880","aliases":["EUVD-2026-3283","GHSA-93w8-83cg-h89g"],"status":"published","title":"OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over","description":"OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00275,"percentile":0.20085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-116","CWE-20","CWE-79"],"published":"2026-01-19T20:55:28Z","modified":"2026-10-28T02:30:33Z","products":[{"vendor":"hackucf","product":"onboardlite"}],"references":[{"url":"https://github.com/HackUCF/OnboardLite/security/advisories/GHSA-93w8-83cg-h89g","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/HackUCF/OnboardLite/commit/1d32081a66f21bcf41df1ecb672490b13f6e429f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23880.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23880","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-23880","title":"OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over","description":"OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.","status":"published","published":"2026-01-19T20:55:28.469Z","modified":"2026-01-20T15:12:32.529Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-79","CWE-116"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-3283","description":"OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.","status":"published","published":"2026-01-19T20:55:28Z","modified":"2026-01-20T15:12:32Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:50.374471Z"}],"nvd":[{"id":"CVE-2026-23880","description":"OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.","status":"published","published":"2026-01-19T21:15:52.357Z","modified":"2026-06-17T10:22:14.78Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-79","CWE-116"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"CVE-2026-23880","title":"OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over","description":"OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.","status":"published","published":"2026-01-19T20:55:28.469Z","modified":"2026-10-28T02:30:33.983006696Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-116","CWE-20","CWE-79"],"updated_at":"2026-11-02T15:44:59.079784Z"}]}}