CVE-2026-1001 - Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

Back Back to CVE browser

MEDIUM

Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

Published Mar 25, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.19%

Description

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.

Affected products

Vendor Domoticz Product Domoticz Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2026.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Domoticz

unaffected

Version	Status	Constraints
0	affected	<2026.1

Remediation

Red Hat statement

This LOW stored XSS vulnerability in Domoticz requires administrator privileges to inject malicious scripts (PR:H) and user interaction to trigger (UI:R). The scope is changed as scripts execute in the victim's browser context. Impact is low to confidentiality and integrity through session hijacking or unauthorized actions. Affects versions prior to 2026.1.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (7)

https://access.redhat.com/security/cve/CVE-2026-1001
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451432
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-15949
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1001
https://www.cve.org/CVERecord?id=CVE-2026-1001
https://www.domoticz.com/2026.1/
release-notespatchRelease Notes
https://www.vulncheck.com/advisories/domoticz-stored-xss-via-hardware-configuration-endpoint
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-1001		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451432		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-15949		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1001
https://www.cve.org/CVERecord?id=CVE-2026-1001
https://www.domoticz.com/2026.1/		release-notespatchRelease Notes
https://www.vulncheck.com/advisories/domoticz-stored-xss-via-hardware-configuration-endpoint		third-party-advisoryThird Party Advisory