CVE-2026-44977Published
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-44977 · Microsoft / collected KEV context
cve-program · CVE-2026-44977
- https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc
- https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631
- https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41
- https://github.com/Countly/countly-server/releases/tag/24.05.50
- https://github.com/Countly/countly-server/releases/tag/25.03.44
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.