CVE-2026-36748: RockRMS Cross Site Scripting Vulnerability

CVE-2026-36748 Overview

CVE-2026-36748 is a stored Cross-Site Scripting (XSS) vulnerability in RockRMS, an open-source relationship management system maintained by the Spark Development Network. The flaw affects RockRMS v16.13 and all releases before v17.7.0. Attackers can inject malicious JavaScript through the Social Media links field in user profiles. When other users view the profile, the injected payload executes in their browser session. According to the Raxis disclosure, the vulnerability enables privilege escalation by capturing session data or performing actions on behalf of higher-privileged users. The flaw is categorized as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can store JavaScript payloads in user profile fields, leading to session theft and privilege escalation when administrators view affected profiles.

Affected Products

RockRMS v16.13
RockRMS versions after v16.13 and before v17.7.0
Spark Development Network RockRMS deployments using vulnerable releases

Discovery Timeline

2026-06-03 - CVE-2026-36748 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-36748

Vulnerability Analysis

The vulnerability resides in the user profile component of RockRMS. The Social Media links field accepts user-supplied URL values without sufficient output encoding. When the application renders the profile page, the stored value is reflected into the HTML response as part of an anchor element. An attacker who supplies a payload such as a javascript: URI or breaks out of the attribute context can execute arbitrary script in the victim's browser. Because the payload is persistent, every viewer of the affected profile triggers the script. Exploitation requires a low-privileged authenticated account to plant the payload and a victim interaction to view the profile, as reflected in the CVSS user-interaction requirement.

Root Cause

The root cause is missing or insufficient sanitization and output encoding of the Social Media URL fields in the user profile. The application trusts the supplied string when constructing profile markup, allowing attribute-context injection. The fix in v17.7.0 introduces stricter validation of URL schemes and proper HTML entity encoding of stored values before rendering.

Attack Vector

An attacker authenticates with a standard RockRMS account and edits their own profile. They place a crafted XSS payload in a Social Media link field. The payload remains stored in the application database. When an administrator or another user navigates to the attacker's profile, the script runs under the victim's session context. The attacker can exfiltrate session cookies, issue privileged administrative requests, or modify other accounts, achieving privilege escalation. See the Raxis Blog on CVE-2026-36748 for the full exploitation walkthrough.

Detection Methods for CVE-2026-36748

Indicators of Compromise

Profile records containing javascript:, data:, or <script substrings in Social Media URL fields
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing user profiles
New administrative accounts or role assignments created without corresponding admin login activity

Detection Strategies

Run database queries against RockRMS user profile tables to flag URL fields containing HTML tags, event handlers (onerror, onclick), or non-https/http URI schemes
Enable web application firewall (WAF) rules that inspect POST bodies submitted to profile-update endpoints for XSS payload signatures
Review HTTP response bodies for unencoded < and > characters within rendered profile pages during dynamic application security testing

Monitoring Recommendations

Monitor RockRMS web server logs for repeated profile edits originating from low-privilege accounts
Alert on administrative actions performed within seconds of an admin loading a user profile page
Centralize browser console error telemetry from admin endpoints to surface unexpected script execution events

How to Mitigate CVE-2026-36748

Immediate Actions Required

Upgrade all RockRMS instances to v17.7.0 or later, where the input sanitization fix is applied
Audit existing user profile records and purge or sanitize any Social Media link values containing script content or non-standard URI schemes
Force a session reset for administrative accounts to invalidate any tokens that may have been captured

Patch Information

The vendor addressed the issue in RockRMS v17.7.0. Administrators should consult the SparkDevNetwork Resource Hub for release notes and upgrade instructions. No backport for the v16.x branch is referenced in the advisory, so migration to v17.7.0 is the supported remediation path.

Workarounds

Restrict profile editing permissions to trusted users until the patch is applied
Deploy a strict Content Security Policy (CSP) that blocks inline scripts and javascript: URIs to limit payload execution
Use WAF rules to reject requests to profile-update endpoints whose Social Media fields contain HTML control characters

bash

# Example Content-Security-Policy header for RockRMS reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';";