Vulnerability · Published Nov 4, 2026 · Assigned by INCIBE
CVE-2026-111040Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Medium 5.1
In plain English
A medium-severity security flaw in Coupa Total Spend Management Platform from Coupa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.2%top 85.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Coupa | Coupa Total Spend Management Platform | 0 – before 04/11/2026 |
Weakness: CWE-80 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N