CVE-2026-39900: Cacti Reflected XSS via auth_profile.php Tab Parameter

Technical summary

This is a reflected XSS vulnerability (CWE-79) residing in the auth_profile.php authentication profile page. The 'tab' parameter is passed to a JavaScript context without proper sanitization or output encoding, allowing an attacker to inject arbitrary JavaScript that runs in the victim's browser with the same privileges as the authenticated session. The CVSS 3.1 score of 6.1 reflects the network-accessible nature, lack of authentication requirement (though social engineering is needed), cross-site scope, and the ability to compromise confidentiality and integrity. The vulnerability does not affect availability or require complex attack conditions.

Business impact

Compromise of user sessions in Cacti environments can lead to unauthorized access to network monitoring data, modification of monitored metrics or thresholds, or pivoting to monitored infrastructure. For organizations using Cacti to monitor critical systems, an attacker exploiting this vulnerability could gain visibility into network topology, performance baselines, and security posture before launching a larger attack. Additionally, if Cacti is integrated with other management platforms via API or shared credentials, the risk extends beyond monitoring visibility.

Affected systems

Cacti versions 1.2.30 and prior are affected. This includes all stable and legacy releases up to and including 1.2.30. The vulnerability is present whenever auth_profile.php is accessible and processes untrusted user input in the 'tab' parameter without sanitization.

Exploitability

Exploitation requires tricking a Cacti user into clicking a specially crafted link containing JavaScript payload in the 'tab' parameter. No authentication bypass is needed, and the attack is trivial to execute technically—constructing the malicious URL is straightforward. However, successful exploitation depends on social engineering; the attacker must convince a victim to visit the link while logged into Cacti. The attack surface is broad if Cacti is internet-facing or accessible to untrusted users, but limited if access is restricted to internal networks or VPN-only.

Remediation

Upgrade Cacti to version 1.2.31 or later, which patches the vulnerability by properly sanitizing and encoding the 'tab' parameter before use in JavaScript context. Organizations should prioritize this upgrade for any Cacti deployments accessible to users outside their direct control or for systems monitoring sensitive infrastructure. Verify patch application by checking the version string and testing that the 'tab' parameter no longer executes arbitrary JavaScript.

Patch guidance

Apply Cacti version 1.2.31 or any subsequent release. Before upgrading, back up your Cacti database and configuration files (typically in /etc/cacti and the MySQL/MariaDB database). Download the patch from the official Cacti repository or release page, verify integrity using available checksums, and test in a non-production environment if possible. After upgrading, clear browser caches to ensure old versions of JavaScript are not served. Verify the fix by attempting to inject a simple test payload (e.g., tab=<img src=x>) and confirming it renders harmlessly rather than executing.

Detection guidance

Monitor web server access logs for suspicious patterns in the 'tab' parameter of auth_profile.php requests, such as encoded script tags, event handlers, or unusual characters. Look for requests containing strings like '%3Cscript%3E', 'onerror=', 'onload=', or similar XSS patterns. Implement a Web Application Firewall (WAF) rule to block requests to auth_profile.php with script-like payloads in query parameters. Monitor application logs for JavaScript errors or warnings if Cacti logs such events. Correlate access logs with user sessions to identify whether any payloads were successfully injected and executed.

Why prioritize this

While the CVSS score is MEDIUM (6.1), the ease of exploitation via social engineering and the potential for attackers to pivot from compromised monitoring visibility into monitored infrastructure elevate practical risk. Organizations with internet-facing or multi-tenant Cacti deployments should treat this as higher priority. However, isolated internal deployments with limited user access carry lower risk and can be scheduled into normal patch cycles.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no authentication requirement (PR:N), and required user interaction (UI:R) to click a malicious link. The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N), and the vulnerability changes scope (S:C) because JavaScript executes in the browser context. The score does not account for social engineering difficulty or the specific risk context of monitoring infrastructure compromise, which may warrant higher severity in certain organizational contexts.

Frequently asked questions