[ CVE-2026-111040 · Published 4 Nov 2026 ]
Vulnerability in Coupa Total Spend Management Platform
CVSS 5.1
No fix listed yet
[ Description ]Official description
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.