CVE-2026-66031

This stored XSS in the Ekushey CRM ticketing module deserves more attention than its CVSS 5.4 suggests. The score treats this as a medium-severity browser vulnerability, but the attack path runs the other direction: external clients submit ticket replies that execute in staff and admin browsers. That reversal matters. In most XSS scenarios, you need to trick a user into visiting a malicious page. Here, the victim must open the ticket as part of their job — it's a forced-rendering surface, not a click-through phishing lure. The attacker contributes nothing except patient injection into a form field they are legitimately authorized to use. The privilege-escalation context amplifies this significantly. A CRM admin session is not just browser state — it typically accesses user records, financial data, third-party integrations, and API credentials. Compromising that session is a hub compromise, not a terminal node. CVSS scope ('changed' for confidentiality/integrity) doesn't capture what an admin can reach downstream. The EPSS score of 0.00165 is misleading here. EPSS tracks exploitation-market activity — tooling availability and exploit circulation. This vulnerability requires no tooling. Every authenticated client on the platform is a potential attacker, and CRM client accounts are frequently auto-provisioned, self-registered, or inherited from integrations. The attacker pool is broad, mutable, and already past the authentication gate. Patch status matters enormously and appears unresolved. Ekushey has not confirmed a fixed version, and CRM vendors typically have slower patch cadences than application frameworks. Organizations running this version should not wait for a vendor patch to act. Immediate steps: render all client-submitted ticket content as plain text in staff/admin dashboards, or apply context-aware escaping that treats client input as untrusted regardless of authentication status. Implement Content Security Policy headers to constrain script execution. Audit client account lifecycle — auto-provisioned accounts, contractor accounts, and dormant profiles represent an expanded attacker surface that the CVSS "authenticated attacker" framing doesn't reflect. The rendering surface between client input and staff view is a trust boundary that authentication alone does not establish.

Reviewed through automated stages and approved by a human before publication.