{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/traq--3.28.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:traq_project:traq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-63198"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["traQ (\u003c 3.28.3)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","oauth2","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Digital Creators Club traP"],"content_html":"\u003cp\u003eThe traQ messenger application (versions prior to 3.28.3) contains an authentication flaw in its OAuth2 implementation. When a silent authorization request (prompt=none) is made with an empty or omitted scope parameter, the application erroneously checks consent against an empty set, effectively bypassing existing restrictions. An attacker controlling an OAuth client can obtain an access token with broader registered scopes than what the user previously approved, provided the user had at least one prior consent entry for that client.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to escalate privileges within the application by obtaining access tokens with excessive permissions without further user interaction.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the traQ messenger application to version 3.28.3 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview OAuth client registrations and audit application access tokens for unexpected scope assignments for users who have interacted with third-party or untrusted OAuth clients.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T20:04:43Z","date_published":"2026-11-03T20:04:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-traq-oauth-bypass/","summary":"The traQ messenger application prior to 3.28.3 fails to validate user consent during OAuth2 silent authorization requests, allowing unauthorized access to broader scopes.","title":"traQ: OAuth2 silent authorization bypass (CVE-2026-63198)","url":"https://feed.craftedsignal.io/briefs/2026-11-traq-oauth-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:trap:traq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-63197"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["traQ (\u003c 3.28.3)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","cve-2026-63197"],"_cs_type":"advisory","_cs_vendors":["traP"],"content_html":"\u003cp\u003etraQ messenger application versions prior to 3.28.3 contain a vulnerability when configured with \u003ccode\u003eTRAQ_STORAGE_TYPE=local\u003c/code\u003e. The \u003ccode\u003e/files/{fileId}\u003c/code\u003e retrieval endpoint returns user-uploaded SVG or HTML content without adequate security headers or sanitization, causing browsers to render the files directly. An attacker with file-upload privileges can upload malicious files containing JavaScript to trigger XSS in the context of other users who view the file.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or theft of sensitive information stored within the traQ application session.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade traQ to version 3.28.3 or later immediately.\u003c/li\u003e\n\u003cli\u003eFor instances where immediate patching is not possible, disable local file storage by modifying the \u003ccode\u003eTRAQ_STORAGE_TYPE\u003c/code\u003e configuration if feasible, or implement strict Content Security Policy (CSP) headers on the web server hosting the traQ application to restrict the execution of inline scripts and unauthorized sources.\u003c/li\u003e\n\u003cli\u003eAudit logs for the \u003ccode\u003e/files/{fileId}\u003c/code\u003e endpoint to identify unusual access patterns or requests for files with SVG/HTML extensions from suspicious user agents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T20:04:38Z","date_published":"2026-11-03T20:04:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-traq-xss/","summary":"The traQ messenger application prior to version 3.28.3 is vulnerable to stored cross-site scripting (XSS) when configured with TRAQ_STORAGE_TYPE=local, allowing attackers to upload crafted SVG or HTML files for unauthorized JavaScript execution in a victim's browser.","title":"traQ: Stored cross-site scripting via file upload (CVE-2026-63197)","url":"https://feed.craftedsignal.io/briefs/2026-11-traq-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - TraQ (\u003c 3.28.3)","version":"https://jsonfeed.org/version/1.1"}