Organizations urged to patch Countly Server to stop low-priv users stealing admin tokens via stored XSS

Countly Server versions prior to 24.05.50 and 25.03.44 are affected by a critical stored cross-site scripting vulnerability. A patch is available for both supported release lines. The issue resides in the star rating plugin, specifically within the API and frontend JavaScript files. Attackers can exploit this to steal session credentials from global administrators.

How it unfolded

• The vulnerability was assigned CVE-2026-44977 by the National Vulnerability Database.
• The flaw was rated with a CVSS score of 9, classified as critical severity.
• The issue stems from improper handling of MIME types during file uploads.
• Fixes were released in versions 24.05.50 and 25.03.44.

Who is affected

According to the NVD record, the vulnerability impacts Countly Server installations running versions older than 24.05.50. It also affects versions in the 25.03 line that are older than 25.03.44. The flaw is specific to the server-side component of the Countly product analytics solution. The weakness is categorized under CWE-79, which covers improper neutralization of input during web page generation.

The attack vector requires a non-global application administrator account. This user can use the `uploadFeedbackFile` function to store attacker-controlled active content. The server trusts the MIME type supplied by the attacker during this upload process. This trust allows malicious scripts to be stored on the server without immediate execution.

The exploitation occurs when a global administrator accesses the feedback preview. The frontend file `app.js` serves the stored content publicly. It uses the attacker-influenced Content-Type header for the response. When the admin opens the preview, the browser executes the payload within the Countly origin. This execution exposes authenticated session capabilities, including the auth_token and csrf_token values.

Our take on the response

The availability of patches in two distinct version lines indicates a rapid response to the discovery. The critical rating reflects the high privilege escalation potential, moving from non-global admin to global admin session theft. The fix addresses the core issue of trusting user-supplied MIME types.

Who needs to act first

Teams should prioritize updating systems exposed to the internet or internal networks with multiple admin accounts. Check whether any non-global administrators have access to the star rating plugin features. Before applying the update, create a full backup of the server configuration and data. Test the patch in a staging environment to ensure analytics functionality remains intact. Roll out the fix to production systems immediately after validation.

Background: Attack vectors

Attack vectors are the paths adversaries use to reach your data. They range from simple phishing emails to complex supply chain compromises. Defending against them requires mapping every entry point, validating inputs, and limiting what each component can do. You cannot stop all attacks, but you can make them costly and slow.

Read the full guide: Attack Vectors Explained: Mechanisms, Limits, and Defense Strategies

What to do and how to stay safe: Countly

• Verify the current version of Countly Server against the affected ranges.
• Update to version 24.05.50 or 25.03.44 as soon as possible.
• Review access logs for unusual file uploads by non-global administrators.
• Monitor for signs of session token theft or unauthorized admin actions.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The vulnerability is identified as CVE-2026-44977.

Which versions of Countly Server are fixed?

Versions 24.05.50 and 25.03.44 contain the fix.

What does the attacker gain from this exploit?

The attacker can steal auth_token and csrf_token values from global administrators.