# CVE-2026-76178: OCS Inventory Ocsreports stored XSS in notification templates

Source: https://junglewise.ai/threats/cve-2026-76178-ocs-inventory-ocsreports-stored-xss-in-notification-templates  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76178 · Severity: info · CVSS 9.2 · Published 2026-09-03

Ocsreports is an open-source asset management platform used to track hardware and software across IT infrastructure. This vulnerability allows a malicious administrator to inject JavaScript code into notification templates that will execute in the browsers of other administrators viewing those templates, potentially allowing account hijacking or unauthorized actions within the application.

## Quick answers

**Is CVE-2026-76178 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76178 being exploited in the wild.

**How severe is CVE-2026-76178?** Informational severity, with a CVSS score of 9.2, published 3 September 2026.

**Which products and versions are affected?** OCS Inventory Ocsreports before 2.12.6.

**Is there a fix for CVE-2026-76178?** A patch was published on 2026-09-03: Fixed in version 2.12.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76178 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76178?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the notification template functionality at endpoint /ocsreports/?function=notification. An authenticated user with administrator privileges can inject malicious HTML and JavaScript into template fields, which are stored without sanitization. When other administrators access the template customization view, the malicious script executes within their browser in the application's security context. Attack requires admin-level access and user interaction (viewing the template page). Successful exploitation could compromise admin sessions, enabling session hijacking or privilege escalation. The vulnerability was patched in OCS Inventory NG version 2.12.6.

## Affected products

- OCS Inventory Ocsreports before 2.12.6

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 2.12.6

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng)