Multiple vulnerabilities in Sisense’s Cloud BI Platform
Posted date 27/10/2026
Identificador
INCIBE-2026-794
Importance
4 - High
Affected Resources
Sisense Cloud BI Platform (SaaS).
Description
INCIBE has coordinated the publication of two high severity vulnerabilities affecting Sisense’s Cloud BI Platform, a cloud-based business intelligence and data analytics platform. The vulnerabilities were discovered by Miguel Jiménez Cámara.
The following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type have been assigned to each of these vulnerabilities:
- From CVE-2026-117493 to CVE-2026-117494: CVSS v4.0: 8.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L | CWE-79
Solution
No solution has been reported as yet.
Detail
- CVE-2026-117493: stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
- CVE-2026-117494: cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.
CVE
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-117493 | Alta | No | SISENSE |
| CVE-2026-117494 | Alta | No | SISENSE |
References list
Etiquetas
