CVE-2026-11443

MediumCVSS 4.6

Published: 13/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Allegra contains a Cross-Site Scripting (XSS) vulnerability in the downloadAttachment method, allowing authentication bypass. The issue results from lack of input validation, enabling arbitrary script injection. User interaction is required (visiting a malicious page or opening a file).

Risk Assessment

The organization is at risk of XSS attacks, which could lead to session theft, account takeover, or unauthorized actions in the victim's context.

Recommendation

Upgrade Allegra to the latest version containing a fix, or apply temporary WAF rules to block suspicious input in the downloadAttachment method.

Other vulnerabilities in Allegra

CVE-2026-11442Medium
A directory traversal vulnerability in Allegra's exportReport method. Allows remote disclosure of sensitive information. Authentication required.

Original NVD description (English source)

Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to execute arbitrary script on affected installations of Allegra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the downloadAttachment method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to execute script in the context of the current user. Was ZDI-CAN-28236.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS