CVE-2026-27787

CVE-2026-27787 is a cross-site scripting (XSS) vulnerability affecting MATCHA SNS version 1.3.9 and earlier, which could allow an attacker to execute arbitrary scripts in the browsers of users accessing the vulnerable application. The vulnerability has been assigned a CVSS score of 5.4 (Medium severity) and requires authenticated access with user interaction to exploit. The attack vector is network-based with low complexity, meaning an attacker with valid credentials can craft a malicious script that executes when a user visits a compromised page, potentially allowing theft of sensitive information or session hijacking. Currently, there is no evidence of active exploitation in the wild, with an EPSS score of 0.0003 indicating minimal real-world attack probability. The vulnerability remains on an inactive status with no known exploit code publicly available, suggesting limited community attention at this time, though organizations running affected versions should still prioritize patching to mitigate potential risks.