Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-49995Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Medium 4.8

In plain English

A medium-severity cross-site scripting in Tautulli from Tautulli. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.6%top 51.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.

Affected products (as reported)

Vendor	Product	Versions
Tautulli	Tautulli	< 2.17.2

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/Tautulli/Tautulli/security/advisories/GHSA-r6pg-vqxj-v75j x_refsource_CONFIRM
https://github.com/Tautulli/Tautulli/commit/12761b2d01e78f22e54e8ad8d3133931147cbb77 x_refsource_MISC
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2 x_refsource_MISC