CVE-2026-36748: RockRMS v16

Synopsis

A stored cross-site scripting (XSS) vulnerability affects RockRMS versions 16.13 and earlier, as well as versions before 17.7.0. The vulnerability is reachable over the network, requires a low-privilege account to inject a malicious payload via a Social Media link in a user profile, and requires a victim to view or interact with the affected profile. Successful exploitation gives an attacker full control over the victim's browser session in the context of the application, enabling data theft, content modification, and arbitrary actions performed as the victim. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the RockRMS service over the network to submit a malicious Social Media link payload.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; the attacker must be able to edit their own user profile to inject the payload.

• Victim interactionRequired

  A victim must view or otherwise trigger the rendering of the attacker's profile page containing the malicious Social Media link for the payload to execute.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configurations beyond the attacker having an account and a victim viewing the profile.

Blast Radius

• Reads session tokens, cookies, and any sensitive data visible in the victim's authenticated browser session.
• Performs arbitrary actions within the application on behalf of the victim, such as modifying account settings or submitting forms.
• Exfiltrates data rendered in the victim's browser context, including personal or organizational records surfaced by the application.
• Injects persistent malicious content into the application interface that executes each time any user views the compromised profile.