Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-9588

Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
SRA

Description

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template_text parameter to be stored server-side and subsequently rendered to other users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sangoma Switchvox SMB Edition

Default version status: unaffected

  • 8.3 (104997) to < 8.4.0.2affected

References