CVE-2026-15552: Ragic Enterprise Cloud Database XSS Flaw

CVE-2026-15552 Overview

CVE-2026-15552 is a Stored Cross-Site Scripting (XSS) vulnerability in Ragic Enterprise Cloud Database. Unauthenticated remote attackers can inject persistent JavaScript that executes in the browser of any user who loads the affected page. The flaw is tracked under CWE-79 and was disclosed through TW-CERT. Because the payload persists server-side, every subsequent visitor becomes a potential victim without further attacker interaction.

Critical Impact

An unauthenticated attacker can store JavaScript that runs in the context of Ragic Enterprise Cloud Database users, enabling session theft, UI manipulation, and phishing pivots against authenticated accounts.

Affected Products

• Ragic Enterprise Cloud Database (vendor-hosted SaaS platform)
• Ragic-based tenant applications rendering user-submitted content
• Any browser session interacting with the affected Ragic pages

Discovery Timeline

• 2026-07-13 - CVE-2026-15552 published to NVD
• 2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15552

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. Ragic Enterprise Cloud Database accepts attacker-controlled input and persists it without sufficient output encoding. When a legitimate user renders the affected page, the browser parses the stored payload as executable JavaScript.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N indicates the flaw is reachable over the network without authentication, but requires a victim to load the affected content. Impact falls on the subsequent (browser) scope, affecting confidentiality and integrity of client-side data. The EPSS probability is 0.205% at the 10.6 percentile, reflecting low current exploitation likelihood.

Root Cause

The root cause is missing or incomplete neutralization of HTML and JavaScript special characters when Ragic renders user-supplied field data. Input written to database records is echoed back into HTML responses without contextual encoding for the destination sink, allowing <script> tags or event-handler attributes to survive to the DOM.

Attack Vector

An unauthenticated attacker submits crafted content to a Ragic form or endpoint that stores data in a shared sheet or record. When any user, including administrators, browses to the record, the injected payload executes in their session. Attackers can then exfiltrate session cookies, issue authenticated API requests, deface the interface, or stage phishing overlays against internal users.

No verified public exploit code is available. Refer to the TW-CERT Security Advisory 11032 and TW-CERT Security Advisory 11031 for vendor guidance.

Detection Methods for CVE-2026-15552

Indicators of Compromise

• Stored records containing <script>, javascript:, onerror=, onload=, or <svg/<img tags with event handlers in Ragic fields not expected to hold HTML.
• Outbound browser requests from authenticated sessions to unfamiliar domains shortly after loading a Ragic sheet.
• Anomalous Set-Cookie or session-token traffic patterns following record views by internal users.

Detection Strategies

• Query the Ragic database for field values matching regex patterns for script tags and inline JavaScript event handlers.
• Deploy Content Security Policy (CSP) reporting endpoints and monitor script-src violation reports originating from Ragic domains.
• Correlate web proxy logs against a baseline of allowed third-party destinations to spot beaconing triggered by injected payloads.

Monitoring Recommendations

• Enable verbose access logging on the Ragic tenant and retain logs for post-incident review.
• Alert on repeated form submissions from a single IP that contain HTML-encoded angle brackets or long URL-encoded strings.
• Monitor administrator accounts for session activity from unexpected IPs or user agents that could indicate hijacked sessions.

How to Mitigate CVE-2026-15552

Immediate Actions Required

• Contact Ragic support to confirm your tenant has received the vendor fix referenced in the TW-CERT advisories.
• Audit existing records for stored payloads and sanitize or remove any field values containing HTML or script content.
• Rotate session tokens and force re-authentication for users who accessed potentially poisoned records.

Patch Information

Ragic operates as a cloud service, so the fix is applied by the vendor. Verify remediation status through the TW-CERT Security Advisory 11032 and the Chinese-language TW-CERT Security Advisory 11031. Confirm with Ragic that server-side output encoding has been applied to all affected sheet-rendering endpoints.

Workarounds

• Restrict form access to authenticated users where feasible to reduce anonymous injection paths.
• Enforce a strict Content Security Policy that disallows inline scripts and unauthorized script sources on Ragic pages served through corporate reverse proxies.
• Train users to report unexpected pop-ups, redirects, or credential prompts encountered inside Ragic sheets.

# Example CSP header to block inline script execution when fronting Ragic via a reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";