Vulnerability · Published Jan 19, 2026 · Assigned by GitHub_M

CVE-2026-23880OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over

High 7.3

In plain English

A high-severity improper input validation in OnboardLite from HackUCF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.

Affected products (as reported)

Vendor	Product	Versions
HackUCF	OnboardLite	< 1d32081a66f21bcf41df1ecb672490b13f6e429f

Weakness: CWE-20, CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/HackUCF/OnboardLite/security/advisories/GHSA-93w8-83cg-h89g x_refsource_CONFIRM
https://github.com/HackUCF/OnboardLite/commit/1d32081a66f21bcf41df1ecb672490b13f6e429f x_refsource_MISC