CVE-2026-26991: LibreNMS /device-groups name Stored Cross-Site Scripting

/device-groups name Stored Cross-Site Scripting

• HTTP POST
• Request-URI(s): “/device-groups”
• Vulnerable parameter(s): “name”
• Attacker must be authenticated with “admin” privileges.
• When a user adds a device group, an HTTP POST request is sent to the Request-URI “/device-groups”. The name of the newly created device group is stored in the value of the name parameter.
• After the device group is created, the entry is displayed along with some relevant buttons like Rediscover Devices, Edit, and Delete.