CVE-2026-44977

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.

• CWE-79

• https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631
• https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41
• https://github.com/Countly/countly-server/releases/tag/24.05.50
• https://github.com/Countly/countly-server/releases/tag/25.03.44
• https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc
• https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc

Published

Oct 16, 2026

Last Modified

Oct 21, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44971GuardDog is a CLI tool to identify malicious PyPI packages. …8.2
• CVE-2026-44972GuardDog is a CLI tool to identify malicious PyPI packages. …5
• CVE-2026-44973Billy is an interface filesystem abstraction for Go. Prior t…8.1
• CVE-2026-44974@hapi/content provided HTTP Content-* headers parsing. Prior…7.7
• CVE-2026-44975Frappe is a full-stack web application framework. Prior to v…5.3
• CVE-2026-44976Frappe is a full-stack web application framework. Prior to v…5.3
• CVE-2026-44978xrdp is an open source RDP server. Versions 0.10.6 and prior…5.3
• CVE-2026-44979@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when…6.3
• CVE-2026-4498Execution with Unnecessary Privileges (CWE-250) in Kibana’s …7.7
• CVE-2026-44981CrowdSec offers crowdsourced protection against malicious IP…8.2
• CVE-2026-44982CrowdSec offers crowdsourced protection against malicious IP…7.2
• CVE-2026-44983smallbitvec is a growable bit-vector for Rust, optimized for…7.3