CVE-2026-23880 HIGH

CVE-2026-23880: OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over

Vendor Hackucf
Product OnboardLite
Weakness CWE-20 · Input validation
Published January 19, 2026
Last update January 20, 2026
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.

Key dates

02Disclosure timeline

January 19, 2026 CVE published
January 20, 2026 Record updated