CVE-2026-54049
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Sakai (CLE) from versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.
Risk Assessment
An attacker can execute scripts in other users' browsers, potentially leading to session theft, data leakage, or malware distribution in the educational environment.
Recommendation
Upgrade Sakai to version 23.5, 25.3, or 26.0. Additionally, consider disabling the Conversations tool until the patch is applied.
Other vulnerabilities in Sakai
See all- CVE-2026-54050Medium
Sakai versions from 23.0 to 23.5 and 25.3 have a vulnerability where an authenticated user can delete another user's profile image via the DELETE /api/users/{userId}/profile/image endpoint, because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership. Similarly, the DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before deleting the target user's recording.
- CVE-2025-62710Medium
Sakai, a Collaboration and Learning Environment, prior to versions 23.5 and 25.0, initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non-cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at-rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.
Original NVD description (English source)
Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS