AdaptiveGRC stored XSS flaw enables privilege escalation
AdaptiveGRC software contains a stored XSS vulnerability (CVE-2026-4313) allowing authenticated attackers to steal admin tokens and escalate privileges.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of CVE-2026-4313, a stored cross-site scripting vulnerability in AdaptiveGRC software. The flaw exists in text-type fields across forms where authenticated attackers can inject malicious JavaScript by manipulating HTTP POST request values. Due to improper server-side validation, the injected code executes in victim browsers when they view the affected fields.
The most critical impact is the potential theft of administrator authentication tokens, enabling attackers to perform arbitrary administrative actions and potentially achieve full system compromise. All AdaptiveGRC versions released before December 2025 are affected by this vulnerability.
The vulnerability was responsibly disclosed by Antoni Kwietniewski from mBank and coordinated through CERT Polska's vulnerability disclosure process. Organizations using AdaptiveGRC should upgrade to versions released after December 2025 to remediate this issue.
Mentioned in this report
Detection guidance
Possible Stored XSS Payload Injection via HTTP POST (AdaptiveGRC CVE-2026-4313)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP POST requests containing inline JavaScript/script tags submitted to AdaptiveGRC form fields, indicative of stored XSS payload injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Stored XSS Payload Injection via HTTP POST
id: a8dce28a-64a3-539e-b7c2-12bdd558b5e9
status: experimental
description: Detects HTTP POST requests containing script tags or inline JavaScript
event handlers in request body/query fields, consistent with stored XSS payload
injection such as CVE-2026-4313 in AdaptiveGRC.
references:
- CVE-2026-4313
logsource:
category: webserver
detection:
selection:
cs-method: POST
payload_indicators:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- 'javascript:'
- document.cookie
condition: selection and payload_indicators
falsepositives:
- Legitimate rich-text or HTML content submitted by trusted administrators
- Security scanners or penetration testers actively testing the application
level: medium
tags:
- attack.t1059.007
- attack.execution
author: Vorant
Suspicious Access Token / Cookie Exfiltration Pattern in Web Requests
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects outbound HTTP requests containing session cookie or authentication token values in URI/query parameters, potentially indicating browser session hijacking following stored XSS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Session Token Exfiltration via HTTP Request
id: f6bbd9fd-807d-5591-91d9-a3eb6abaa0e3
status: experimental
description: Detects outbound HTTP GET/POST requests where the query string or body
appears to contain session cookie or token values, consistent with exfiltration
of stolen administrator session tokens after a stored XSS attack (e.g. CVE-2026-4313).
references:
- CVE-2026-4313
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- document.cookie
- sessionid=
- auth_token=
- PHPSESSID=
condition: selection
falsepositives:
- Legitimate application debugging or analytics scripts that echo cookie values for
troubleshooting
- Internal monitoring tools that log session identifiers for support purposes
level: medium
tags:
- attack.t1185
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4313
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs