High · published January 16, 2026
⚡ A sneaky vulnerability lets script code execute right in your browser when viewing Time Entry notes! 🚨 Think of it like a restaurant serving a dish with a hidden allergen; without proper checks, unsuspecting diners could have a serious reaction. In this case, the Time Entry notes are the dish, and the missing output encoding is that dangerous ingredient that could harm users. An attacker could craft a valid time entry note containing malicious scripts that execute when viewed by users. This means they could steal cookies, hijack sessions, or perform actions as if they were the user, leading to potentially devastating consequences for your data security.
Think of it like a restaurant serving a dish with a hidden allergen; without proper checks, unsuspecting diners could have a serious reaction. In this case, the Time Entry notes are the dish, and the missing output encoding is that dangerous ingredient that could harm users. This vulnerability in ConnectWise PSA versions before 2026.1 arises from not properly encoding output in Time Entry Audit Trail notes, allowing for stored cross-site scripting (XSS) attacks when the content is rendered in a user's browser.
An attacker could craft a valid time entry note containing malicious scripts that execute when viewed by users. This means they could steal cookies, hijack sessions, or perform actions as if they were the user, leading to potentially devastating consequences for your data security. Upgrade ConnectWise PSA to version 2026.1 or later immediately to patch this vulnerability. Additionally, ensure to review and encode any user inputs to prevent similar attacks in the future. You've got this! Follow these steps, and you'll secure your system in no time! 🛡️